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Aging  Aircraft  Fleets:  Structural  and  Other 
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Executive  Summary 

Aging  aircraft  concerns  have  dramatically  escalated  in  the  military  community  during  the  past  decade. 
The  percentage  of  aircraft,  operated  beyond  their  original  design  life  both  in  terms  of  flight  hours 
and/or  calendar  years  is  steadily  increasing.  Some  models,  which  have  already  been  in  service  for  more 
than  30  years,  will  need  to  be  retained  for  another  two  decades  or  longer,  often  serving  in  roles  and  in 
theaters  very  different  from  what  was  envisioned  when  they  were  originally  designed. 

Aging  Aircraft  has  several  connotations.  Among  them:  (a)  technological  obsolescence,  (b)  the  need  for 
system  upgrading,  (c)  changing  mission  requirements,  (d)  the  specter  of  runaway  maintenance  costs, 
(e)  concern  about  safety,  (f)  impairment  of  fleet  readiness  and  (g)  possible  unavailability  of  home 
depot  facilities.  However,  if  there  is  one  thread  that  runs  through  the  above  list,  it  is  the  adverse  impact 
on  sustainment  of  the  fleet. 

There  are  other  considerations  when  dealing  with  the  Aging  Aircraft  issue;  for  example,  availability  of 
spare  parts,  processes  and  tooling  may  no  longer  be  available,  logistic  procedures  may  have  changed 
and  suppliers  may  be  out  of  the  business.  Budgetary  limitations  and  higher  fleet  utilization  will 
increase  the  demand  to  cope  with  aging  aspects  for  the  structure  and  major  subsystems  like  engines 
and  avionics.  Awareness  in  the  user  community  about  typical  challenges  and  technical  solutions  can 
ameliorate  some  of  the  concerns.  New  technologies  are  now  available  for  dealing  with  many  of  the 
aging  aircraft  concerns.  They  relate  to  inspection,  repair  and  corrosion-resistant  materials,  structural 
modeling  and  more  sophisticated  maintenance  scheduling.  Thus  a  Lecture  Series  (LS)  under  the 
auspices  of  the  NATO  Partnership  for  Peace  (PfP),  is  proposed,  the  main  emphasis  of  which  will  be  an 
in-depth  discussion  of  these  new  technologies  and  methods.  The  LS  will  cover  aspects  of  systems 
upgrades  and  structural  airworthiness  linked  to  fixed  wing  and  helicopter  fleets  with  emphasis  on  life 
enhancement  strategies  used  by  NATO  nations. 

The  material  in  this  publication  was  assembled  to  support  Lecture  Series  218  bis  under  the  sponsorship 
of  the  Applied  Vehicle  Technology  Panel  (AVT)  and  the  Consultant  and  Exchange  Programme  of  RTO 
presented  13-16  November  2000  in  Sofia,  Bulgaria. 
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le  Vieillissement  des  flottes  d’avions  militaires  : 
aspects  structures  et  autres  sous-systemes 

(RTO  EN-015  /  AVT-053) 


Synthese 

Le  probleme  du  vieillissement  des  aeronefs  militaires  s’est  considerablement  amplifie  au  cours  de  la 
derniere  decennie.  Le  pourcentage  d’ aeronefs  en  exploitation  au-dela  de  leur  duree  de  vie  theorique, 
tant  du  point  de  vue  d’heures  de  vol  que  d’annees  de  service,  augmente  regulierement.  Certains 
modeles,  deja  en  service  depuis  plus  de  30  ans,  devront  etre  maintenus  pendant  encore  deux  decennies 
au  moins,  souvent  pour  des  missions  et  des  theatres  tres  differents  de  ceux  qui  etaient  envisages  a 
l’origine. 

Le  terme  “aeronefs  vieillissants”  a  plusieurs  connotations  differentes,  parmi  lesquelles  l’on  peut 
distinguer :  (a)  l’obsolescence  technologique,  (b)  la  necessite  de  proceder  a  la  mise  a  niveau  d’un 
systeme,  (c)  F  evolution  de  la  mission,  (d)  le  spectre  des  couts  de  maintenance  incontroles,  (e)  des 
considerations  de  securite,  (f)  l’attenuation  de  l’etat  de  preparation  de  la  flotte  et  (g)  la  non- 
disponibilite  des  depots  de  base.  Mais  tous  ces  aspects  ont  un  facteur  commun  :  l’impact  negatif  sur  le 
maintien  de  la  flotte. 

II  y  a  aussi  d’ autres  considerations  a  prendre  en  compte;  par  exemple  la  disponibilite  de  pieces  de 
rechange,  de  processus  et  d’outillage,  les  procedures  logistiques  qui  peuvent  avoir  change  et  les 
fournisseurs  qui  peuvent  avoir  fait  faillite.  Les  limitations  budgetaires  et  l’utilisation  accrue  des  flottes 
aeriennes  necessiteront  de  porter  plus  d’ attention  aux  aspects  de  vieillissement  de  la  structure  et  des 
sous-systemes  principaux  des  aeronefs,  tels  que  les  moteurs  et  l’avionique.  Une  meilleure 
sensibilisation  des  utilisateurs  aux  defis  et  aux  solutions  techniques  typiques  pourrait  pallier  certains  de 
ces  problemes.  De  nouvelles  technologies,  qui  permettront  de  resoudre  bon  nombre  de  ces  questions, 
sont  desormais  disponibles.  Elies  concement  l’inspection,  la  reparation,  les  materiaux  resistants  a  la 
corrosion,  la  modelisation  structurale  et  1’ amelioration  de  la  programmation  de  la  maintenance. 

Par  consequent,  il  est  propose  d’organiser  un  Cycle  de  Conferences  (LS)  sous  l’egide  du  programme 
OTAN  de  Partenariat  pour  la  paix  (PfP),  dont  l’objectif  principal  sera  de  permettre  une  discussion 
approfondie  de  ces  nouvelles  technologies  et  methodes.  Le  Cycle  de  Conferences  couvrira  tous  les 
aspects  de  la  modernisation  des  systemes  et  de  F  aptitude  au  vol  du  point  de  vue  structural  des  flottes 
d’avions  a  voilure  fixe  et  d’helicopteres,  l’accent  etant  mis  sur  les  strategies  d’extension  de  la  duree  de 
vie  adoptees  par  les  pays  membres  de  l’OTAN. 

Cette  publication  a  ete  redigee  pour  servir  de  support  de  cours  pour  le  Cycle  de  conferences  218  bis, 
organise  par  la  Commission  de  AVT  dans  le  cadre  du  programme  des  consultants  et  des  echanges  de  la 
RTO  du  13-16  novembre  2000  a  Sofia,  Bulgarie. 
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LOADS  MONITORING  and  HUMS 

G.  Gunther 

DaimlerChrysler  Aerospace  GmbH 
Military  Aircraft,  MT22,  Postfach  80  1 1  60 
81663  Munich,  Germany 


SUMMARY 

The  fatigue  life  of  aircraft’s  in  service  is  different  from  the  design  life  for  many  weapon  systems  not  only  due  to  the 
extended  need  for  the  airframe  as  a  platform  for  new/upgraded  systems  (life  extension),  but  also  due  to  different  usage 
compared  to  the  initial  design  spectmm.  Monitoring  of  the  life  consumption  is  therefore  essential  to  assess  practicability 
and  cost  effectiveness  of  planned  upgrades  and  modifications.  Methods  and  concepts  to  establish  the  "used  life"  are 
described  for  two  different  types  of  fixed  wing  aircraft’s  and  the  influence  of  aircraft  missions  and  -equipment  as  well  as 
structural  weight  increase  over  time  are  discussed. 

New  integrated  health  monitoring  systems  with  intelligent  data  processing  and  software  capable  comparing  actual  events  or 
accumulated  damage  /  wear  with  predefined  limits,  evaluate  their  criticality  and  provide  information  to  other  systems  are 
presented. 

0.  BACKGROUND 

The  effectiveness  of  military  force  depends  in  part  on  the  operational  readiness  of  aircraft  which  itself  is  largely  dependent 
on  the  condition  of  the  airframe  stmcture.  This  condition  again  is  affected  by  a  number  of  factors  among  those  the  physical 
loads  in  various  forms  together  with  the  used  life  of  the  airframe  are  important.  With  increased  and  extended  usage  of 
airframes  in  all  airforce  inventories  and  the  requirement  for  various  role  changes  the  subject  of  airframe  loads-monitoring 
becomes  more  important,  not  only  for  flight  safety  but  also  and  with  an  increasing  tendency  for  economic  reasons. 

1.  LOADS  MONITORING  AND  6 ‘FATIGUE  LIFE”  OF  AIRFRAMES 

1.1  Historical  Overview 

Fatigue  management  requirements  and  techniques  have  evolved  over  a  period  of  more  than  40  years,  originating  from 
simple  cg-acceleration-counters  to  multi-channel  systems  with  on-board  processing  capabilities.  Originally  a  driving  factor 
for  load  measurements  was  the  generation  of  databases  for  design  purposes,  especially  the  wing  loads  and  the  wing  to 
fuselage  interface  was  of  interest  for  subsonic  and  aerodynamically  stable  A/C-  configurations.  Combining  the  data  with 
parameters,  easy  to  retrieve  like  speed,  altitude,  weight  and  time  this  transformed  later  into  the  bases  for  a  first  set  of 
"fatigue  meters",  used  as  a  tool  to  record  repeated  service  loads  on  the  airframe. 

During  1960  and  1970  the  fact  that  loads  on  many  parts  of  the  structure  could  not  be  related  in  any  way  to  c.g.-  acceleration 
and  the  simplified  approach  of  the  fatigue  meters  led  to  improved  methods  of  fatigue  monitoring.  The  first  approaches  to 
monitor  on  a  fleetwide  basis  evolved  and  the  philosophy  of  monitoring  local  fatigue  sensitive  areas,  using  mechanical  strain 
recorders,  see  Fig.  1.1-1. 


Fig.  1.1-1  Princip  of  Mechanical  Strain  Recorder 
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Later  calibrated  strain  gages  on  the  structure  were  introduced  to  record  strain  histories  and  calculate  fatigue  damage,  either 
locally  on  so-called  “hot  spots”  or  for  the  overall  component  via  load  calibration  processes. 

In  1968  the  NATO  Military  Committee  required  an  AGARD-SMP-Study  on  "Fatigue  Load  Monitoring  of  Tactical 
Aircraft"  which  subsequently  presented  agreed  conclusions  and  recommendations  for  efforts  to: 

*  Establish  statistical  relationships  between  movement  parameters  and  structural  loads 

*  Develop  simple  strain  recording  techniques 

*  Establish  fatigue  life  monitoring  techniques  for  all  NATO  countries 

Within  the  last  two  decades  a  number  of  concepts  for  aircraft  loads  monitoring  with  either  fleetwide  data  recording, 
supplemented  by  additional  data  from  limited  number  of  aircraft  representative  for  squadron  usage  or  individual  aircraft 
tracking  methods  have  been  developed  (1). 

1.2  Loads  Monitoring  and  Damage  Rate  Assessment 

Monitoring  of  the  airframe  loading  scenarios  and  technologies  to  assess  the  "Used  Life"  or  "Damage  Rate"  of  airframe 
structures  are  key  elements  to  the  management  of  an  ageing  aircraft  fleet.  The  term  Ageing  Aircraft  can  be  defined  in  many 
different  ways,  among  them  are  flight  hours  (or  equivalent  flight  hours)  approaching  the  designed  service  life;  number  of 
flights  reaching  the  projected  number  of  ground-air-ground  cycles;  or  even  pure  age  in  the  form  of  calendar  years. 

From  a  structures  point  of  view  the  governing  factor  for  ageing  airframes  is  the  degradation  of  strength  and  rigidity  of 
structural  components  with  time  and  usage,  applied  to  the  aircraft  as  damage  of  different  nature,  the  most  obvious  ones 
being  fatigue  cracks  and  corrosion.This  degradation  will  continue,  increase  and  finally  form  a  threat  to  safety  of  flight 
without  appropriate  actions  in  the  form  of  prevention,  detection  and  repair  through  scheduled  maintenance  efforts. 
Therefore  terms  like  "Damage  Rate",  “Fatigue  Life  Expended”  or  “Fatigue  Index”  have  been  identified  as  an  indicator  for 
the  structural  status  of  an  aircraft,  where  a  rate  of  100%  or  1.0  identifies  the  end  of  the  designed  fatigue  life  of  a  component 
or  the  limit  for  economic  repair  and  usage  of  the  aircraft. 

1.2.1  The  Object  of  Fatigue  Monitoring  Programs 

In  service  individual  aircraft’s  are  subject  to  different  operational  loading  causing  different  damage  rates  in  their  fatigue 
prone  areas.  Dependent  on  how  an  aircraft  is  used,  it  may  have  an  expended  life  significantly  different  from  what  is 
predicted  at  the  time  of  service  entry. 

The  simple  fact  is  that  aircraft  are  often  not  used  the  way  they  were  intended  to  be  used  during  design  and  aircraft  are  used 
differently  even  when  flown  for  similar  missions. 

Fig.  1.2. 1-1  shows  an  example  for  consumed  fatigue  life  of  TORNADO  lower  wing  skins  for  aircraft  with  comparable 
missions,  Fig.  1.2. 1-2  the  wing  root  bending  life-consumption  for  Canadian  CF-18vs  from  one  squadron.  Factors  of  up  to  5 
for  the  damage  rate  have  been  identified  between  the  most  and  least  severe  flown  aircraft.  If  no  fatigue  monitoring  program 
for  individual  aircraft  is  carried  out,  maintenance  actions,  modifications  and  finally  retirement  of  the  equipment  is  based  on 
the  number  of  flight  hours  which  the  most  severe  flown  aircraft  is  allowed  to  accumulate. 


Fig.  1 .2.1  -1  Lower  Wing  Skin  Life  Consumption  for  Similar  Missions,  TOR 
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CF~18  FATIGUE  USAGE  HAHAGEMEHT  ENVELOPE  •  SOON  410 
CONTROL  OF  INDIVIDUAL  FATIGUE  DAMAGE 

Fig.  1.2.1 -2  Wing  Root  Bending  Life  Consumption,  CF-18 


Hence,  a  sound  and  comprehensive  operational  loads  data  acquisition  and  evaluation  will  be  an  effective  tool  for  cost 
savings  during  the  operational  life  of  an  aircraft. 

With  consideration  of  the  life  already  consumed  and  with  predictions  about  further  usage  the  remaining  service  life  of 
components  can  be  determined  and  actions  to  adopt  fatigue  enhancement  policies  can  be  initiated  at  least  for  loads  initiated 
damage,  i.e.  aircraft’s  with  high  damage  rates  can  be  allocated  to  fly  less  severe  missions/configurations  or  structural 
modifications  can  be  introduced  before  fatigue  damage  occurs. 

Any  monitoring  and  fatigue  assessment  program  is  therefore  set  up  to  answer  the  question: 

"What  is  the  fatigue  life  ratio  of  the  operational  stress  spectrum  rated  against  the  design/test  spectrum  on  the  different 

airframe  locations  ?  " 

or: 

"How  many  operational  flight  hours  are  equivalent  to  a  simulated  flight  hour  during  fatigue  testing  ?" 
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1.2.2  Structural  Monitoring  Concepts  and  Systems 

The  main  activities  during  a  structural  monitoring  concept  to  determine  the  consumed  life  of  each  individual  airframe  are 
shown  in  Fig.  1 .2.2-1. 


Fig.  1. 2.2-1  Structural  Monitoring  Activities 


The  initial  step  of  Loads  and  Component  Data  Aquisition  is  performed  using  flight  data  recorders  for  overall  aircraft  load 
parameters  and  local  sensors  for  fatigue  critical  areas  together  with  aircraft  identification  information  (MTail-No. -Tracking") 
or  component  information  for  exchangeable  items  (i.e.  horizontal  stabilators). 

Special  post-processing  is  needed  to  separate,  correct  or  replace  faulty  data. 

The  Damage  Calculation  is  performed  with  respect  to  the  design  philosophy  of  the  aircraft: 

*  For  Safe  Life  -  structures  the  calculation  is  based  on  S/N-curves  and  Miners  rule  to  determine  the  accumulated 
damage. 

*  For  Damage  Tolerant  designed  structures  initial  flaws  are  assumed  and  crack  growth  analysis  is  performed  for  each 
fatigue  critical  part  of  the  structure,  ensuring  that  the  initial  flaw  of  a  given  size  (i.e.  0.005  in  or  0.127mm)  will  not 
grow  to  a  functional  impairment  size  within  a  given  lifetime.Inspections,  replacements  or  repair  actions  are  scheduled 
by  durability  analysis  using  the  flight  loads  data  in  the  form  of  cycle  by  cycle  stress  histories  coupled  by  probability  of 
detection  (POD)  data. 

From  the  registered  loads  data,  a  Derivation  of  Standard  Load  Sequences  or  Spectra  (SLS)  is  extracted  to  create  specific 
parameter  or  load  histories.  They  should  fulfil  the  following  criteria: 

*  The  mean  damage  of  the  registered  load  sequence  of  individual  A/C  should  be  equal  to  the  mean  damage  of  the  SLS 

*  The  distribution  of  actual  missions,  configurations  and  other  relevant  operational  parameters  should  be  characteristic 
for  the  A/C  operational  usage.  In  some  cases  different  SLS  or  spectra  have  to  be  generated  for  one  A/C,  i.e.  Training-, 
Air-to-Air  or  Air-to-Ground  dominated  usage. 

The  Fatigue  Life  Substantiation  is  demonstrated  through  fatigue  analysis  and  a  qualification  process  including  component 
and  full  scale  fatigue  tests  in  the  development  phase,  validation  of  loads  within  flight  envelope  tests  as  well  as  operational 
experience  during  A/C-usage. 
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Since  the  tests  are  usually  carried  out  within  or  in  direct  sequence  with  the  design  phase  and  based  on  the  loads  and 
structural  configuration  status  of  this  time,  deviations  during  the  operational  usage  phase  are  normally  scaled  to  the  fatigue 
test,  determining  the  so-called  "Usage  Factor". 

Assessment  of  the  allowable  fatigue  life  depends  on  the  results  of  the  fatigue  life  substantiation  (in  most  cases  the  full  scale 
test)  and  the  design  philosophy.  Demonstrated  fatigue  test  hours  divided  by  the  scatter  factor  and  linked  to  the  standard 
load-spectrum  are  the  limit  for  a  safe  life  designed  structure,  whereas  for  damage  tolerant  structures  the  test  hours  leading  to 
cracks  that  impairs  function  of  the  structure  divided  by  a  factor  are  considered  for  the  Calculation  of  Fatigue  Life. 

The  Consumed  Life  or  Damage  Rate  for  each  component  is  the  relation  of  the  actual  individual  A/C  damage  calculation 
and  the  allowable  life  and  is  used  to  schedule  inspections,  replacements  or  repair  actions  in  order  to  ensure  structural 
integrity. 

1.2.3  Aircraft  Fatigue  Tracking  Systems  for  the  GAF-TORNADO 

The  TORNADO  Multi  Role  Combat  Aircraft  was  designed  in  the  early  "70  and  followed  the  safe  life  design  principal  for 
durability  with  a  scatter  factor  of  4,  used  on  the  design  life  of  4000  FH.  The  fatigue  tracking  concept  of  the  A/C  is  divided 
into  three  sectors  with  different  numbers  of  aircraft’s  from  the  fleet  involved  and  different  amount  of  data  (parametric  and 
strain  gages)  gathered,  as  shown  in  Fig.  1. 2.3-1. 


Effort  for 

AircraftTracking  (AT) 
Segments 


Number  of  Aircraft's 
for  Data  Acquisition 


IAT: 

Individual  AT 
SAT: 

Selected  AT 
TAT: 

Temporary  AT 


100% 


IAT  SAT  TAT 


Fig.  1 .2.3-1  Aircraft  Tracking  Segments,  TOR 


Monitoring  is  based  essentially  on  flight  parameters,  which  are  available  through  the  existing  flight  recorder  unit  and 
defined  as  Recorder  Parameter  Set  (RPS). 

An  extended  Full  Parameter  Set  (FPS)  is  generated  through  differentiation’s  and  conversions  of  existing  data.  The  flight 
recorders  are  distributed  on  a  statistically  representative  basis  throughout  the  squadrons  and  register  the  spectrum  of 
selected  aircraft.  Additionally,  strain  gages  in  various  fatigue  critical  areas  of  the  structure  are  monitored  on  a  limited 
number  of  aircraft,  the  results  are  evaluated  by  regression  techniques  to  produce  a  realistic  correlation  between  operational 
strain  on  the  structure  and  the  flight  parameters  causing  it. 
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A  reduced  Pilot  Parameter  Set  (PPS)  is  collected  from  each  individual  aircraft  through  the  Nz-counter  plus  aircraft  weight 
and  configuration  data,  see  Fig.  1.2. 3 -2  on  a  flight  by  flight  bases. 


Pilot  Parameter: 


Fig.  1 .2.3-2  Reduced  Parameter  Set  (PPS)  for  IAT 


Thus,  a  "multi-lever  tracking  is  performed: 

*  Individual  Aircraft  Tracking  with  Pilot  Parameter  Set 

*  Temporary  Aircraft  Tracking  with  Recorder  Parameter  Set  +  Strain  gages 

*  Selected  Aircraft  Tracking  with  Full  Parameter  Set 

Fig.  1.2. 3-3  lists  the  recorder  parameter  set  and  strain  gage  sampling  rates  for  the  Temporary  Aircraft  Tracking  level. 


No. 

Parameter 

Sampling 

Rale  /  s 

No. 

Parameter 

Sampling 
Rate  /  s 

1 

Pressure  Altitude 

0.5 

11 

Inboard  Spoiler  STBD 

1.0 

2 

Calibrated  Airspeed 

0.5 

12 

Rudder  Position 

2.0 

3 

Normal  Acceleration 

16.0 

13 

Wing  Sweep  Angle 

0.5 

4 

True  Angle  Of  Attack 

2.0 

14 

Primary  Strain  Gauge 

16.0 

5 

Roll  Rate 

8.0 

15 

Secondary  Strain  Gauge 

4.0 

6 

Pitch  Rate 

4.0 

16 

Rap  Position 

1.0 

7 

Yaw  Rate 

2.0 

17 

Slat  Position 

1.0 

8 

Taileron  Pos.  PT 

4.0 

18 

Fuel  Remaining 

1.0 

9 

Taileron  Pos.  STBD 

4.0 

19 

Stores  Configuration 

4.0 

10 

Outboard  Spoiler  PT 

1.0 

20 

Oleo  Switch 

0.5 

21 

Identification  Data 

1.0 

Fig.  1. 2.3-3  Recorder  Parameter  Set  Data  and  Sampling  Rates 
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From  a  conception  point  of  view,  the  individual  aircraft  tracking  permits  optimum  utilisation  of  the  structural  life  of  a  fleet. 
This  naturally  requires  appropriate  sensors  existing  in  the  individual  aircraft  for  the  acquisition  of  local  stress  history  data. 
Since  not  all  of  the  TORNADO  aircraft’s  are  equipped  with  strain  gages,  PPS  acquired  by  IAT  are  converted  via  the 
regression  table  from  TAT-A/C  into  stress  spectra  for  the  fatigue  critical  areas. 

Monitoring  of  the  TORNADO'S  fatigue  critical  areas  uses  the  local  strain  concept,  too.  For  this,  a  suitable  local  strain 
measurement  location  was  established  for  every  area  during  the  Full  Scale  Fatigue  Tests.  Fig.  1. 2.3-4  shows  an  example  for 
a  critical  area  in  the  engine  duct ,  where  "reference"  strain  gages  are  located  at  the  wingbox  shearlink  to  the  fuselage  for  on¬ 
board  monitoring. 


Local  Strain  Calibration 


Fig.  1 .2.3.-4  Reference  Strain  Gage  on  Wing  Attachment 

The  damage  in  the  duct  location  is  traced  to  the  wing  bending  moment.  By  applying  the  transfer  functions  for  inner  wing 
shear  force  and  bending  moment  to  the  recorder  parameter  set  and  the  correlation  equation  for  the  reference  gage  from 
fatigue  test,  the  stress  history  for  this  area  is  generated. 

1.2.4  On-Board  Loads  Monitoring  System  of  Canadian  Forces  CF-18  Aircraft  (2) 

Usage  characterisation  of  the  CF-18  fleet  is  also  a  key  element  of  fatigue  life  management  of  the  CAF  F-18  fleet.  In 
contrary  to  the  TORNADO,  all  of  the  CF-18  aircraft  are  equipped  with  strain  gage  sensors  at  different  locations  during 
production,  see  Fig.  1.2.4. -1. 


STRAIN  SENSOR  LOCATIONS 

Vertical  Tall  Horizontal  Tall 


Fig.  1. 2.4-1  CF-18  Strain  Gage  Locations 
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Flight  parameters  are  recorded  together  with  the  strain  gage  signals  on  a  flight  by  flight  bases  within  the  Maintenance 
Signal  Data  Recorder  (MSDRS)  and  allow  individual  aircraft  tracking  throughout  the  service  life  of  every  aircraft. 

Location  of  the  strain  gages  were  selected  by  the  manufacturer  based  on  criticality  of  the  structure,  its  accessibility  and  the 
degree  of  protection  from  accidental  damage.  Prime  and  spare  gages  are  applied  for  redundancy.  Use  of  the  direct  strain 
measurements  inherently  accounts  for  parameters  like  airspeed,  altitude,  weight,  store  configuration  and  cg-variations 
during  flight.  However,  the  accuracy  of  the  fatigue  calculation  is  dependent  upon  the  reliability  and  proper  installation  of 
the  sensor. 

Data  are  stored  on  magnetic  tape  and  downloaded  to  a  ground  station.  Different  level  of  data  reduction  and  reporting  can  be 
generated  from  limited  fatigue  analysis  codes  at  operating  bases  to  assess  severity  of  individual  flights  or  mission  profiles  to 
annual  reports  for  long-term  trend  analysis. 

Since  the  F-18  was  also  designed  to  a  safe  life  philosophy,  fatigue  consumption  is  calculated  in  terms  of  Fatigue  Life 
Expended  (FLE)  against  the  6000  FH  life  of  the  design  usage  spectrum.  This  linear  relationship  was  established  using  the 
information  collected  during  full  scale  fatigue  test  conducted  by  the  manufacturer  and  is  scaled  for  CF  in-service  usage  and 
structural  configuration  changes  between  test  article  and  fleet. 

For  the  purpose  of  fatigue  calculations,  crack  initiation  was  defined  as  formation  of  a  crack  of  0.25  mm  or  O.Olinches. 
Cracks  usually  originate  at  locations  of  tensile  stress  concentrations,  where  material  strength  is  exceeded  when  high  load 
magnitudes  are  frequently  encountered  in-service. 

From  the  in-flight  MSDRS  recorded  strain  peaks  and  valleys,  a  representative  loading  spectrum  is  generated,  and  by  using 
the  individual  material  stress-strain  relationship  of  the  components,  the  corresponding  stress  spectrum  is  obtained. 

From  this  spectrum  the  amount  of  damage  per  cycle  and  afterwards  the  crack  initiation  life  can  be  calculated  by  using 
material  dependent  S/N-curves,  Fig.  1. 2.4-2. 


1 )  NEUBER'S  RULE  2)  HVSTEftlStS  CURVE  I 

equivalent  STRAIN 


The  FLE  is  then  expressed  as  the  total  damage  accumulation  to  date  divided  by  the  total  structural  fatigue  damage  required 
to  initiate  a  0.25  mm  crack  under  the  design  loading  spectrum. 

After  initiation,  remaining  life  of  the  component  is  used  by  crack  growth  up  to  the  critical  crack  length.  Currently,  the 
fatigue  analysis  program  does  not  contain  a  crack  growth  prediction  model. 
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Together  with  fatigue  awareness  and  control  programs,  reducing  configuration  severity  for  missions,  within  2  years  of 
implementation,  the  CF  was  able  to  improve  fleet  attrition  trends  already  by  approx,  one  year  of  service,  Fig.  1. 2.4-3 


CF-18  FLEET  ATTRITION  PROJECTIONS  (1990) 


Fig.  1. 2.4-3  Life  Improvement  of  CF-18  Fleet 


Some  of  the  experiences  with  the  system  of  individual  aircraft  tracking  through  strain  gage  sensors  are: 

*  Fatigue  damage  calculations  are  improved  by  direct  strain  measurements  due  to  elimination  of  A/C  flight  parameters 
from  the  equations 

*  Accuracy  of  the  measurements  are  vital  and  gage  drift  over  time  is  a  concern 

*  In  flight-calibration  of  gages  through  reference  manoeuvres  during  maintenance  test  flights  can  be  a  solution  to  gage 
drift 

*  Reliability  of  the  strain  sensor  is  vital,  since  drop-outs  must  be  replaced  with  conservative  "fill-in" -algorithm,  leading 
to  artificially  higher  FLE  data. 

*  Timely  reporting  schedules  are  essential  for  feedback  of  damage  accumulation  and  on  the  effects  of  role 
changes/aircraft  usage  to  the  operational  squadron  as  well  as  to  the  fleet  manager. 

2.  INFLUENCE  OF  THE  STRUCTURAL  CONFIGURATION  STATUS 

An  aircraft  in  service  or  produced  over  an  extended  period  of  time  will  change  its  structural  and  system  configuration  in 
many  areas  due  to  structural  modifications,  additional  systems  installed,  improved  engine  performances  etc. 

While  major  structural  modifications  are  usually  covered  by  either  extensive  analysis,  accompanied  by  component  testing 
and  sometimes  even  full  scale  tests,  the  smaller  modifications  and  "updated"  system  installations  are  well  documented  in 
production  configuration  control  files,  but  mostly  "neglected"  for  internal  loads  influence  for  some  time. 
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Fig.  2.0-1  shows  the  increase  of  the  TORNADO  structural  mass  aft  of  the  rear  transport  joint,  including  vertical  and 
horizontal  tail  components  for  the  different  batches  within  a  production  period  of  14  years  together  with  the  design  weight 
used  in  the  unified  analysis  in  1976. 

TORNADO 

Mass  History  of  Aft  Fuselage  +  Vert.  Tail  +  Horiz.  Tail 

4300,0 

4200,0 

4100,0 

4000,0 
M 

a  3900,0 
s 

S  3800,0 

k  3700,0 
9 

3600,0 
3500,0 
3400,0 
3300,0 

1971  1972  1973  1974  1975  1976  1977  1978  1980  1981  1982  1985  1986  1987  1988  1991 

Fig.  2.0-1  Historic  Structural  Mass  Increase  of  TOR  Aft  Fuselage 


The  "immediate  solve"  for  weight  increase  of  reducing  internal  fuel  and  keeping  the  Nz-level  (Nz  x  m  =  constant)  will 
obviously  not  work  for  this  problem,  based  on  the  fuel  sequence  the  wet  wing  mass  definition  is  no  longer  valid  and  leads 
to  higher  wing  loads.  The  same  effect  is  also  valid  for  the  front  fuselage,  as  explained  in  the  previous  paper  “AIRCRAFT 
LOADS”. 

At  the  same  time  engine  thrust  has  been  raised  also  by  16%,  although  only  a  fraction  of  it  is  used  during  peacetime 
operations,  the  heavier  engine  contributes  to  the  mass  increase.  More  important,  in  contradiction  to  a  special  role 
equipment,  which  may  be  cleared  with  restrictions  like  "Not  for  peacetime  training  missions",  this  mass  increase  influences 
the  fatigue  life  consumption  permanently  during  every  flight  hour  and  every  manoeuvre. 

The  influence  of  the  higher  loads  can  be  clearly  seen  on  the  structural  transport  joint  loading  leading  to  vertical  shear  load 
increase  of  approx.  20  kN  or  4500  klbs  and  vertical  bending  of  30  KNm  or  265000  inlbs  respectively  an  additional  6.5  % 
based  on  the  design  limit  loads,  Fig.  2.0-2. 


3800.  3900.  4000.  4100.  4200.  4300.  3800.  3900.  4000.  4100.  4200.  4300. 

REAR  FUSELAGE  MASS  (KG)  REAR  FUSELAGE  MASS  (KG) 


Fig.  2.0-2  Interface  Load  Increase  at  Rear  Transport  Joint 
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A  regular  check  of  the  present  inertia  loads  status  after  modifications  and  system  upgrades  is  therefore  mandatory  to  make 
loads  monitoring  concepts,  based  on  parametric  data,  work. 

3.  HEALTH  AND  USAGE  MONITORING  SYSTEMS  (HUMS)  FOR  AGING  AIRCRAFTS 

The  major  research  in  the  area  of  smart  vehicle  technologies  including  integrated  health  and  usage  monitoring  systems 
for  inherent  or  onboard  diagnostic  of  the  structural  status  is  directed  towards  future  aircraft  to  improve  performance, 
reliability  and  survivability  or  reduce  pilot  loads.  Some  of  this  technology  will  also  be  applicable  to  existing  fleets  of 
fixed  and  rotary  wing  aircraft’  s  and  help  to  improve  flight  safety  and  reduce  maintenance  cost. 

While  onboard  computing  devices  already  offer  means  to  process  strain  gage  readings  and  flight  parameter  data  during 
flight  or  at  the  end  of  every  mission,  the  subsequent  analysis  of  this  ever  increasing  data  base  require  careful 
consideration  for  fleet  management  and  maintenance  planning.  The  need  for  automation  of  the  data  reduction  including 
diagnostic  software  to  support  the  decision  making  process  is  vital  for  the  future. 

At  the  same  time  care  needs  to  be  taken  in  defining  analysis  and  handling  techniques  for  the  enormous  amount  of  data 
that  is  generated  and  becomes  the  basis  for  decisions,  affecting  flight  safety  and  maintenance  procedures,  thus  becoming 
a  certification  item  itself. 

3.1  The  HUMS  Procedure 

The  key  elements  of  any  HUMS  are  the  real  time  diagnostic  of  the  structural  status  of  the  aircraft  using  a  sensor,  linked 
to  a  processor  and  display  unit  and  an  intelligent  software  to  compare  actual  events  or  accumulation  of  damage  /  wear 
with  predefined  limits,  evaluate  the  criticality  and  provide  information  to  other  systems  like  pilot  alert  or  maintenance 
recording  units  for  later  retrieval. 

Sensors  used  must  have  the  capability  to  detect  the  type,  extent  and  location  of  the  damage  within  the  component 
without  being  disturbed  by  the  in  flight  environment  (noise,  vibration,  temperatures  etc.)  and  should  have  the  robustness 
to  endure  the  airframes  life,  not  creating  an  additional  /  critical  maintenance  issue. 

Processors  obtain,  verify  and  process  the  sensor  data  through  software  routines  and  perform  the  health  assessment  for 
the  component.  The  output  is  either  stored  for  subsequent  usage  within  a  maintenance  data  recorder  unit  or  displayed 
onboard  during  flight  for  event  alert. 

Software  includes  data  collection,  analysis  algorithm  and  expert  systems  to  initiate  the  “decision  making  process”.  In 
some  cases  Neural  Network  technology  has  been  promoted  to  link  loads  and  fatigue  data  to  flight  parameters,  especially 
for  rotorcraft  where  direct  measurement  of  local  data  through  strain  gages  are  difficult  or  inappropriate  (i.e.  on  rotating 
elements  for  vibration  loads).  However,  these  Neural  Networks  require  training  and  validation  (especially  when  HUMS 
is  used  within  the  certification  process)  which  again  can  only  be  measured  using  direct  techniques. 

Fig.  3.1-1  gives  a  schematic  overview  of  a  HUMS  architecture  for  structural  applications. 


Personnel 


Personnel 


Fig.  3.1-1  Schematic  overview  of  HUMS  architecture 
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3.2  Sensors 

The  following  table  gives  an  overview  of  sensors  commonly  evaluated  in  HUMS  programs: 


Sensor  Type 

Structural  Application 

Acoustic  Emission 

Damage  Detection,  Cracks,  Delaminations,  Impacts 

Acousto  Ultrasonics 

Damage  Detection,  Cracks,  Delaminations,  Impacts 

Modal  Analysis 

Vibration  modes,  Damage  Detection 

Strain  Gage 

Strain  Measurement 

Fibre  Optic 

Strain  Temperature  Pressure 

Crack  Gage 

Crack  Growth 

Accelerometer 

C.G.  or  Local  Acceleration,  Vibration,  Buffet 

Pressure  Transducer 

Pressure 

Displacement  Transducer 

Structural  Deformation 

Electro  Chemical 

Corrosion,  Environment 

Thermocouple 

Temperature 

While  strain  gages,  accelerometers  and  thermocouples  are  well  known  sensors  used  in  existing  fatigue  monitoring 
programs,  fibre  optics  and  acoustic  emission  sensors  have  found  recent  application  in  research  programs  for  health 
monitoring  of  structures.  While  isolated  sensor  function  and  data  collection  on  coupon  level  is  well  understood,  the 
sensor  array,  the  distribution  architecture  and  the  method  to  collect  and  analyse  data  on  complex  structures  is  still  being 
developed. 

Since  for  metallic  structures  the  dominant  mechanical  damage  are  fatigue  cracks,  the  sensor  must  be  able  to  identify 
damage  as  small  as  2.5  mm  in  areas  like  sharp  radii,  around  fasteners  or  in  build-up  structure  without  knowing  the 
precise  location  up-front. 

3.3  Structural  Application  of  HUMS 

Application  of  HUMS  to  detect  and  monitor  fatigue  damage  in  metallic  structure  has  been  successfully  demonstrated 
during  ground  testing  on  coupons,  complex  sub-elements  and  full  scale  structures.  Fig  3.3-1  shows  the  application  of 
acoustic  emission  sensors  located  in  the  web  of  a  typ.  machined  bulkhead  in  an  array  around  the  critical  location  of  the 
hole.  During  the  monitoring  phase,  the  major  tasks  of  the  systems  is  to  identify  and  “filter”  structural  noise  from  damage 
events,  identify  crack  initiation  and  monitor  crack  growth. 
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Fig.  3.3-1  Acoustic  emission  sensors  in  web  area  of  frame 


While  in  simple  structures  the  distance  from  crack  location  to  sensor  to  detect  events  can  be  as  far  as  450  mm,  a  more 
complex  structure  with  joints  or  geometric  discontinuities  requires  the  sensors  much  closer  to  the  expected  failure 
location  to  obtain  reliable  results. 

Fig.  3.3-2  shows  monitoring  locations  on  a  full  scale  testarticle,  were  “hot  spots”  were  monitored  during  a  9000 
spectrum  flight  hour  fatigue  test.  Failure  occurred  in  Zone  No.  4  just  prior  to  the  9000  h  inspection  and  the  system  was 
able  to  discriminate  signals  due  to  crack  growth  from  background  noise,  starting  at  app.  7000  spectrum  flight  hours. 


Fig.  3.3.-2  Full  scale  test  article  with  monitoring  loactions 
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Fig.  3.3-3  shov 
and  the  crack  g: 
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A  different  method  of  monitoring  structural  health  is  shown  in  Fig.  3.3-4,  a  fibre  optic  array  embedded  in  the  composite 
structure  during  manufacturing  of  the  part.  This  technology  has  been  mainly  applied  to  advanced  composites  on  research 
and  test  bench  level.  Issues  like  the  effect  of  the  fibre  on  the  basis  material,  robustness  and  long  term  stability  of  the 
fibre  and  the  sensor  interface,  repairability,  sensitivity  of  the  sensor  and  degradation  with  damage  occurring  are  a  few 
areas  for  continuos  research. 


Fig.  3.3-4  Fibre  Optic  monitoring  array  embedded  in  structure 


The  two  major  tasks  of  structural  health  monitoring: 

-  Identification  of  events  /  damages 

-  Continuous  monitoring  of  loads  within  the  structure  could  be  achieved  within  one  system  and  using  one  sensor  only, 
if  the  system  is  designed  accordingly. 

The  fibre  would  have  adequate  sensitivity  to  measure  strain  levels  and  detect  anomalies  that  might  indicate  the 
development  of  structural  weakness  through  fatigue  and/  or  local  damage,  while  impact  damage  above  a  predefined  level 
would  lead  to  a  radical  signal  response  change  and  in-flight  or  post  mission  actions  would  be  triggered. 

While  today’s  existing  and  ageing  fleets  of  fixed  wing  aircraft  and  helicopters  still  rely  on  direct  monitoring  methods 
and  these  technologies  need  to  be  refined  for  future  applications,  the  fully  integrated  HUMS  on  individual  component 
level  will  lead  to  higher  exploitation  of  structural  life  for  existing  structures,  an  option  for  on  condition  maintenance  if 
cost  effective  and  the  reduction  of  some  conservatism  in  the  design  process  of  new  weapon  systems. 
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Summary 

Fatigue  is  a  failure  mode  in  aircraft  that  emerged  in  the  fifties  and  sixties  as  a  significant 
threat  to  their  structural  integrity.  Since  that  time,  the  research  community  has 
extensively  studied  the  phenomenon  and  has  developed  the  technology  to  describe  the 
propagation  of  fatigue  cracks  in  a  structure.  This  paper  describes  an  approach  that,  when 
followed,  will  virtually  eliminate  catastrophic  failures  from  this  mechanism. 

Introduction 

Most  engineering  structures,  particularly  metallic  components,  when  subjected  to  cyclic 
loading  have  the  potential  for  failing  below  their  pristine  strength.  Such  a  failure  is 
referred  to  as  a  fatigue  failure.  There  is  a  progressive  degradation  of  the  strength  from 
cracks  emanating  from  manufacturing  damage,  in-service  induced  damage,  or  intrinsic 
defects  in  the  material.  Constant  amplitude  testing  is  used  to  characterize  the  residual 
strength  of  a  structural  member  after  it  has  been  subjected  to  a  specified  number  of 
loading  cycles.  This  paper  examines  the  approaches  that  researchers  have  used  to  prevent 
catastrophic  structural  failure  resulting  from  cyclic  loading. 

Except  for  those  failures  resulting  from  exceeding  the  operational  envelope  of  the  aircraft, 
structural  failures  prior  to  the  mid-forties  were  rare.  One  reason  for  this  is  that  before  the 
mid-forties,  aircraft  rarely  accumulated  sufficient  flight  time  on  their  aircraft  to  suffer 
from  fatigue  failures.  Further,  the  ductile  materials  and  conservative  methods  used  for 
analysis  tended  to  preclude  failures.  Experience  has  shown  that  early  aircraft 
manufactured  with  ductile  materials  and  designed  based  on  static  strength  only  are 
typically  safe  from  failure  caused  by  fatigue  for  at  least  1000  flight  hours.  It  was  rare  for 
a  combat  aircraft  in  World  War  II,  for  example,  to  remain  operational  for  more  than  1000 
hours.  The  demand  for  improvements  in  performance  in  the  late  forties;  however, 
introduced  new  materials  with  high  strength,  but  few  other  virtues.  Further,  the  demand 
for  performance  improvements  reduced  analytical  conservatism  and  introduced  designs 
that  were  to  operate  at  high  altitudes.  The  design  community  appeared  oblivious  to  the 
consequences  of  their  actions.  Even  before  the  time  of  the  first  flight  by  the  Wright 
Brothers,  fatigue  was  a  major  issue  in  many  industries.  In  the  railway  industry  alone, 
fatigue  failures  of  wheels  caused  numerous  deaths.  These  failures  seemed  to  make  no 
impression  on  aircraft  designers.  The  success  they  had  stemming  from  the  days  of  the 
Wright  Brothers  appeared  to  continue  without  interruption  although  fatigue  failures  in 
aircraft  can  be  traced  back  to  the  late  twenties. 

The  reality  of  the  consequences  of  aging  came  sharply  into  view  for  the  United  States  Air 
Force  (USAF)  on  March  13,  1958  [1]  when  they  lost  two  B-47  aircraft  because  of  fatigue 
cracking  in  the  wing.  It  was  on  this  day  that  the  aging  aircraft  research  effort  started  for 
the  USAF.  The  USAF  did  not  specify  a  service  life  for  the  B-47.  Consequently,  they 
based  the  design  on  the  assumption  that  failure  from  overload  was  the  only  threat  to  its 
structural  integrity.  This  was  common  practice  for  aircraft  designed  in  the  late  forties 
such  as  the  B-47.  Review  of  the  then  current  literature  on  structural  design  provided  no 
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hint  fatigue  was  a  serious  consideration.  However,  the  USAF  intended  to  maintain  the 
aircraft  in  service  until  1965.  The  technical  basis  for  maintaining  the  aircraft  in  service 
for  that  length  of  time  did  not  exist. 

The  1958  failures  motivated  the  USAF  to  establish  the  USAF  Aircraft  Structural  Integrity 
Program  (ASIP).  The  USAF  designed  this  program  for  use  with  new  weapon  systems 
acquisition  for  their  inventory.  The  program  as  originally  conceived  defined  a  sequence 
of  tasks  that  progressively  reduced  the  risk.  These  tasks,  composed  of  analyses  and  tests, 
included  all  efforts  for  the  qualification  of  USAF  aircraft.  This  concept  is  just  as  valid 
today  as  it  was  in  1958.  The  approach,  although  sound  in  its  concept,  had  a  fatal  defect. 
The  original  program  incorporated  a  reliability  concept  called  safe  life  to  qualify  the 
structure  for  the  loads  environment  expected  in  operational  service.  The  USAF 
determined  the  safe  operational  life  from  the  results  of  a  full-scale  fatigue  test  of  the 
structure.  They  conducted  this  test  in  a  laboratory  environment.  They  divided  the  number 
of  successfully  tested  flight  hours  by  a  factor  called  the  “scatter  factor.”  The  scatter 
factor  (usually  in  the  interval  from  two  to  four)  supposedly  accounted  for  material 
property  and  fabrication  variations  in  the  population  of  aircraft.  The  trouble  with  this 
approach  was  that  it  did  not  preclude  the  use  of  low  ductility  materials  operating  at  high 
stress.  Unfortunately,  it  was  at  this  time  that  aluminum  companies  were  introducing  high 
strength  alloys  in  response  to  the  insatiable  desire  for  improved  aerodynamic  performance. 
Consequently,  the  “safe  life”  concept  did  not  eliminate  the  in-service  failures  the  USAF 
designed  it  to  prevent.  The  “safe  life”  approach  adopted  by  the  USAF  in  1958  proved  to 
be  ineffective  in  eliminating  fatigue  cracking  as  evidenced  by  the  failures  in  operational 
aircraft. 

Probably  the  most  significant  in-service  event  since  1958  that  changed  the  original 
version  of  the  ASIP  was  the  failure  of  an  F-lll  in  Decemberl969.  F-111A  number  94  (SN 
67-049)  failed  on  22  December  1969  as  a  result  of  a  wing  failure  in  the  lower  plate  of  the 
left  wing  pivot  fitting.  At  the  time  of  failure,  the  aircraft  had  approximately  100  hours  of 
flight  time.  Catastrophic  loss  of  this  F-lll  demonstrated  the  fatal  defect  in  the  "safe  life" 
method.  That  is,  the  safe  life  method  did  not  preclude  designs  that  were  intolerant  to 
manufacturing  and  service-induced  defects.  Other  losses  (e.g.,  F-5,  B-52,  and  T-38)  and 
incidents  of  serious  cracking  (e.g.,  KC-135)  during  this  period  confirmed  this 
shortcoming.  These  failures  lead  to  a  new  approach  for  the  protection  of  USAF  aircraft 
safety,  a  damage  tolerance  approach.  The  approach  selected  by  the  USAF  was  damage 
tolerance.  The  concept  of  damage  tolerance  is  discussed  in  detail  in  Section  2.  The  basis 
for  the  process  is  to  assume  the  structure  has  a  flaw,  a  sharp  crack,  that  is  the  least  upper 
bound  of  the  expected  flaw  distribution.  The  operator  makes  inspections  such  that  the 
crack  does  not  reach  the  point  of  rapid  propagation  before  it  is  detectable.  The  damage 
tolerance  approach  is  in  a  state  of  continual  improvement  because  research  and 
development  has  lead  to  better  methods  in  fracture  mechanics  methods  and  stress  analysis 
over  the  last  thirty  years.  The  introduction  of  damage  tolerance  principles  by  the  USAF  in 
their  structural  inspection  program  in  the  early  seventies  virtually  eliminated  fatigue  as  a 
safety  issue  in  their  aircraft. 

The  USAF  incorporated  the  damage  tolerance  approach  in  the  ASIP,  and  in  1975,  they 
published  the  process.  This  program,  for  a  new  acquisition,  provides  a  series  of  time 
related  tasks  that  will  provide  progressive  risk  reduction  in  the  progression  of  the 
engineering  and  manufacturing  development  phase  of  procurement.  The  current  version  of 
the  ASIP  includes  five  separate  tasks  that  cover  all  aspects  of  the  development  and 
support  of  an  aircraft  structure.  For  any  given  program,  if  the  USAF  does  not  plan  to 
include  a  specific  element,  then  they  must  establish  the  rationale  and  potential  impact  on 
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the  structural  integrity  of  the  weapon  system  for  the  exclusion.  The  main  tasks  of  ASIP 
[2]  are  as  follows: 

I.  Design  Information 

II.  Design  Analyses  and  Development  Tests 

III.  Full-Scale  Testing 

IV.  Force  Management  Data  Package 

V.  Force  Management 

The  original  goals  of  ASIP  were  to  (1)  control  structural  failure  in  operational 
aircraft,  (2)  devise  methods  of  accurately  predicting  service  life,  and  (3)  provide 
design  and  test  approach  that  will  avoid  structural  fatigue  problems  in  future 
weapon  systems. 

The  ASIP  is  also  the  standard  by  which  the  USAF  can  evaluate  aging  aircraft  issues  for 
structural  components.  For  this  purpose,  the  USAF  normally  emphasizes  a  subset  of  the 
elements  of  ASIP.  For  example,  they  extracted  the  appropriate  elements  of  this  program 
to  perform  the  damage  tolerance  assessments  (DTAs)  during  the  seventies  and  eighties. 
The  Air  Force  invested  approximately  one  million  man-hours  in  that  effort  to  provide  an 
inspection  and  modification  program  that  greatly  enhanced  the  safety  of  aging  aircraft. 
Aging  aircraft  for  many  years  have  had  a  significant  influence  on  the  USAF  research  and 
development  programs  and  have  been  a  major  driving  influence  on  the  elements  of  the 
ASIP. 

Two  of  the  main  products  of  the  ASIP  process  are  development  of  the  report  on  strength 
and  operating  restrictions  and  the  development  of  the  Force  Structural  Maintenance  Plan 
(FSMP).  If  there  is  a  need  to  change  either  of  these  documents  because  of  flight  beyond 
design  usage  that  could  introduce  new  critical  areas,  corrosion,  WFD,  or  repairs,  then  the 
aircraft  is  said  to  be  in  a  state  of  aging. 

Experience  with  operational  aircraft  has  shown  they  rarely  fly  according  to  their  design 
spectrum  of  loads.  Data  from  flight  load  recorders  have  typically  shown  there  are 
considerable  differences  in  usage  severity  among  aircraft  with  the  same  designation.  The 
USAF  often  finds  the  average  aircraft  usage  is  more  severe  than  originally  perceived  early 
in  the  design  process.  This  finding  is  made  more  significant  by  the  fact  the  damage 
tolerance  analysis  may  have  not  identified  an  area  that  would  be  a  concern  for  aircraft 
with  usage  more  severe  than  that  assumed  for  design.  Experience  has  shown  the  mass  of 
an  aircraft  increases  because  of  additional  equipment  or  modification  after  an  aircraft 
enters  operational  service.  In  addition,  there  are  differences  because  there  are  changes  in 
pilot  techniques  as  they  become  more  familiar  with  the  aircraft,  and  mission  changes 
because  of  new  weapons  and  tactics.  The  aircraft-to-aircraft  variability  comes  from 
several  sources  such  as  base  to  base  variations  in  distance  to  test  ranges  and  training. 
These  experiences  tend  to  degrade  the  capability  of  the  full-scale  durability  test  that 
consisted  of  two  lifetimes  of  average  usage  to  identify  all  the  areas  of  the  aircraft  that 
could  potentially  cause  a  loss  of  safety.  In  most  cases,  an  update  of  the  DTA  can  account 
for  any  change  needed  in  the  inspection  or  modification  program. 

For  the  past  forty  years,  the  United  States  Air  Force  has  used  the  USAF  Aircraft 
Structural  Integrity  Program  (ASIP)  to  maintain  safe  and  economical  operation  of  aging 
aircraft.  This  program  has  been  supported  over  the  years  by  USAF  laboratory  programs  in 
the  areas  of  fracture  mechanics,  corrosion  prevention,  flight  loads,  nondestructive 
evaluation,  human  factors,  and  maintenance  and  repair.  These  efforts  provided  the  Air 
Force  with  the  technology  required  to  support  the  operational  aircraft  maintenance 
programs  based  on  damage  tolerance. 
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As  indicated  above,  the  USAF  significantly  changed  this  program  because  of  the  failure  of 
an  F-lll  in  1969.  This  event  ushered  in  the  era  of  damage  tolerance  in  the  USAF  [3]. 
The  first  assessments  performed  on  the  C-5A  and  the  B-1A  in  1971  and  1972  help  derive 
the  original  DTA  requirements  for  the  USAF.  These  requirements  were  derived  for 
monolithic  (i.e.,  slow  crack  growth)  structures.  The  failure  of  an  F-4  wing  on  23  January 
1973  in  a  structural  location  the  USAF  considered  fail-safe  demonstrated  to  them  that  a 
structure  could  not  be  fail-safe  without  an  inspection  program.  This  failure  strongly 
influenced  the  damage  tolerance  requirements  as  initially  established  first  in  MIL-A- 
83444  and  subsequently  in  AFGS-87221A.  The  technology  for  the  analysis  of  fail-safe 
designs  has  evolved  slowly,  primarily  because  of  the  need  for  extensive  finite  element 
programs  supported  by  expensive  test  programs.  The  change  to  a  damage  tolerance 
approach  prompted  considerable  research  and  development  in  the  area  of  fracture 
mechanics.  The  then  Air  Force  Flight  Dynamics  Laboratory  was  the  focal  point  for  much 
of  this  research.  In  the  sixties  and  seventies,  they  developed  much  of  the  fracture 
technology  that  is  still  in  use  today.  In  addition,  since  the  damage  tolerance  approach 
forced  the  engineer  to  better  understand  the  stresses  in  the  structure,  finite  element 
techniques  emerged  as  the  method  of  choice  for  the  stress  analysis.  These  capabilities 
permitted  the  USAF  to  perform  a  DTA  of  all  the  major  weapon  systems  in  the  inventory  in 
the  seventies  and  eighties.  This  effort  required  over  one  million  man-hours  to  complete 
and  every  major  manufacturer  was  involved  with  this  activity.  Because  of  this  activity, 
industry  was  able  to  develop  the  technology  required  for  this  type  of  analysis.  This 
technology  is  also  suitable  for  application  to  new  aircraft  developments.  Consequently, 
the  USAF  was  able  to  include  damage  tolerance  requirements  in  the  specification  for  new 
aircraft  procurement. 

After  completion  of  the  DTA  on  every  major  weapon  system  [4],  the  USAF  laboratories 
continued  research  in  other  areas  associated  with  aging  aircraft.  One  of  these  was  to  make 
a  better  determination  of  the  durability  of  aircraft.  For  this  purpose,  they  sponsored 
research  in  the  determination  of  initial  crack  distributions  in  aircraft  structures.  Much  of 
this  effort  was  concentrated  on  the  interpretation  of  the  cracks  found  in  the  teardown 
inspection  of  the  F-16  wing  after  completion  of  the  durability  test.  Another  effort  related 
to  aging  aircraft  was  the  development  of  the  procedure  for  the  evaluating  the  probability 
of  failure  for  a  population  of  aging  aircraft. 

The  need  for  nondestructive  inspection  technology  to  enable  the  damage  tolerance  driven 
inspections  has  been  a  major  thrust  of  the  Air  Force  for  many  years.  Among  these 
technology  programs  was  a  major  effort  to  determine  the  probability  of  crack  detection  in 
an  operational  environment.  Both  the  USAF  and  the  FAA  recognize  the  need  for 
continuing  the  effort  to  quantify  the  capability  of  inspection  techniques  since  this 
capability  is  critical  to  flight  safety. 

There  are  significant  research  and  development  efforts  currently  underway  in  the  area  of 
nondestructive  evaluation  of  aging  aircraft.  NASA  LaRC  and  several  academic 
institutions  including  Iowa  State  University  and  Johns  Hopkins  University  are  doing  much 
of  this  work.  The  USAF  is  working  with  these  institutions  and  the  FAA  Technical  Center 
to  ensure  these  efforts  meet  the  their  requirements. 

The  USAF  research  and  development  program  for  aging  aircraft  has  provided  the 
technology  base  for  safe  and  economic  operation  of  military  aircraft  through  the  ASIP. 
As  an  indicator  of  this  success,  the  failure  rate  for  all  systems  designed  to  and/or 
maintained  to  the  current  policy  is  one  aircraft  lost  due  to  structural  reasons  in  more  than 
ten  million  flight  hours.  This  is  significantly  less  than  the  overall  rate  of  aircraft  losses 
from  all  causes  by  two  orders  of  magnitude.  It  has  also,  at  times,  given  program  managers 
a  false  sense  about  the  remoteness  of  structural  failures.  This  success,  however,  should 
not  be  used  to  indicate  there  is  no  need  for  continued  research  on  the  structure  of  aging 
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aircraft.  The  return  on  the  investment  in  this  research  is  reduced  cost  and  downtime  with 
inevitable  structural  problems. 

As  indicated  above,  the  materials  in  many  aircraft  were  the  result  of  the  desire  for 
improved  performance  with  little  attention  given  to  the  potential  for  corrosion  and  stress 
corrosion  cracking  damage.  Further,  at  the  time  of  manufacture  of  many  of  these  aircraft, 
the  focus  on  corrosion  protection  was  not  what  it  is  today.  Many  of  these  early  corrosion 
protection  systems  have  broken  down.  In  the  open  areas,  the  operator  can  readily  renew 
them.  There  is,  however,  no  easy  way  to  renew  the  corrosion  protection  system  in  the 
numerous  joints.  Experience  with  modification  and  repair  of  aging  aircraft  has  revealed 
that  joints  without  proper  protection  experience  significant  damage  that  results  in  costly 
part  replacements. 

The  corrosion  concern  is  now  becoming  more  acute  in  that  the  environmental  protection 
laws  have  eliminated  the  use  of  some  of  the  standard  corrosion  inhibitors.  Another  issue 
is  that  the  nondestructive  evaluation  techniques  are  marginal.  The  standards  for  corrosion 
damage  are  so  poorly  defined  that  it  is  difficult  to  properly  characterize  the  damage 
found.  This  deficiency  creates  a  real  problem  in  the  future  years  cost  projection  for 
structural  maintenance. 

The  Damage  Tolerance  Assessment  (DTA)  Process 

The  definition  of  damage  tolerance  is  the  following: 

Damage  tolerance  is  the  attribute  of  a  structure  that  permits  it  to  retain  it  required 
residual  strength  for  a  period  of  unrepaired  usage.  It  must  be  able  to  do  this  after  it  has 
sustained  specified  levels  of  fatigue,  corrosion,  accidental,  or  discrete  source  damage. 
Examples  of  such  damage  are  (a)  unstable  propagation  of  fatigue  cracks,  (b)  unstable 
propagation  of  initial  or  service  induced  damage,  and/or  (c)  impact  damage  from  a 
discrete  source. 

Figure  1  shows  the  steps  in  the  DTA  process.  This  description  applies  primarily  to  the 
process  used  by  the  USAF.  The  procedure  used  by  commercial  operators  is  quite  similar.. 
The  DTA  is  an  integral  part  of  the  aging  aircraft  program  for  both  military  and 
commercial  aircraft.  The  concept  is  simple.  The  flight  time  to  the  first  inspection  is 
based  on  the  time  required  for  the  largest  defect  expected  in  a  fleet  of  aircraft  from 
manufacturing  or  in-service  damage  to  grow  to  critical  crack  length.  Subsequent 
inspections  are  based  on  flight  time  for  the  NDI  detectable  defect  size  to  grow  to  critical 
crack  length.  A  crack  growth  function  illustrating  this  process  is  shown  in  Figure  2. 


Crack  Length  in  millimeters 
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Figure  1  The  Damage  Tolerance  Process 
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The  ordinate  of  the  point  A  is  the  initial  flaw  assumed  for  the  analysis.  The  abscissa  of 
the  point  B  is  half  the  time  needed  for  the  initial  flaw  to  grow  to  critical.  The  ordinate  of 
the  point  C  is  the  NDI  detectable  crack  length.  This  crack  is  then  grown  to  the  point  D 
whose  abscissa  is  half  the  time  required  for  crack  to  grow  from  B  to  critical  crack  length. 
The  process  is  repeated  until  the  inspections  reveal  an  actual  crack  or  the  structure  needs 
to  modification  for  WFD. 

The  process  evolved  over  a  period  of  several  years  after  the  USAF  applied  it  initially  to 
the  B-1A  and  the  C-5A.  Its  successes  include  the  F-4,  an  aircraft  that  did  not  have  a 
requirement  for  life  when  the  U.S.  Navy  procured  it.  The  USAF  purchased  this  aircraft  in 
large  quantities,  and  it  became  an  essential  ingredient  of  their  fighter  fleet.  After  a  crash 
at  Nellis  Air  Force  Base  in  1973  caused  by  fatigue,  the  USAF  found  themselves  in  a 
difficult  situation.  They  initiated  a  recovery  program  that  included  a  DTA  and  fatigue  test 
conducted  in  their  laboratory  at  Wright-Patterson  Air  Force  Base.  Because  of  this  effort, 
the  F-4  remained  in  operational  service  until  the  nineties  without  further  incident.  During 
the  seventies  and  eighties,  the  USAF  performed  a  DTA  of  every  major  weapon  system  in 
their  inventory  [17].  These  successes  motivated  the  USAF  to  apply  this  technology  to 
engine  structures  with  similar  results.  The  discussion  below  describes  the  method  used 
for  damage  tolerance  with  examples  on  how  the  USAF  applied  it. 

The  first  task  of  the  DTA  is  the  identification  of  critical  areas  of  the  structure.  A  critical 
area  is  a  location  or  part  of  the  structure  that  could  affect  flight  safety  and  may  need 
maintenance  in  the  form  of  an  inspection  or  modification  during  the  life  of  the  aircraft. 
There  are  several  techniques  for  identification  of  these  areas.  Actual  cracking  experience 
through  service  operations  or  durability  testing  is  usually  the  most  important 
consideration.  Areas  that  have  high  predicted  or  measured  stress  and  details  that  make 
them  prone  to  cracking  are,  of  course,  prime  candidates  for  the  assessment.  Another 
consideration  in  the  selection  of  critical  areas  is  its  ease  of  inspection.  In  general,  the 
analyst  gives  higher  priority  for  selection  on  critical  areas  difficult  to  inspect.  It  has  been 
extremely  helpful  to  use  the  accrued  knowledge  of  the  original  aircraft  contractor  in 
identifying  potentially  critical  areas.  On  some  of  the  assessments,  preliminary  estimates 
were  made  of  the  flaw  growth  in  the  candidate  critical  areas.  When  this  of  inspection.  In 
general,  the  analyst  gives  higher  priority  for  selection  for  areas  that  are  difficult  to 
inspect.  It  has  been  extremely  helpful  to  use  the  accrued  knowledge  of  the  original 
information  was  available,  it  was  much  easier  to  make  a  decision  on  which  of  the 
candidate  areas  the  analyst  should  subject  to  a  final  analysis.  For  small  aircraft,  the 
number  of  candidate  areas  generally  was  of  the  order  of  40  to  70.  The  analyst  would 
normally  be  able  to  screen  these  down  to  10  to  30  for  final  analysis.  For  larger  aircraft, 
the  number  of  candidate  areas  generally  was  of  the  order  of  60  to  150.  The  analyst  would 
screen  these  down  to  30  to  60  for  final  analysis. 

The  second  task  of  the  DTA  is  the  development  of  the  stress  spectrum  for  each  area 
identified  for  a  final  analysis.  This  is  one  of  the  more  demanding  aspects  of  the  DTA 
process.  The  reason  is  there  are  significant  changes  in  the  rate  of  flaw  growth  due  to 
relatively  small  changes  in  the  cyclic  stresses.  To  perform  this  task  properly,  generally 
three  data  items  must  be  available  to  the  analyst.  First,  he  must  have  operational 
experience  available  in  a  usable  form.  This  operational  data  must  provide  a  basis  for 
establishing  a  flight-by-flight  sequence  of  points  in  the  sky  (i.e.,  altitude,  weight,  and 
aircraft  motion  parameters).  This  was  usually  available  from  multi-channel  data  on 
fighter  or  attack  aircraft.  For  transport  category  aircraft,  the  USAF  usually  derived  the 
sequence  from  flight  log  information  supported  by  multi-channel  data  to  define  the 
maneuver  and  gust  environment.  In  all  cases  except  one,  there  was  a  sufficient  database 
to  derive  the  sequence.  This  exception  was  the  A-7D,  which  was  equipped  with  counting 
accelerometers  only.  Consequently,  as  a  part  of  the  A-7D  DTA,  an  operational  data  base 
was  derived  from  collecting  1,250  hours  of  multi-channel  data  from  aircraft  located  at  two 
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bases.  The  second  data  item  necessary  for  the  derivation  of  the  stress  spectra  is  the  set  of 
equations  needed  to  determine  the  external  loads  (i.e.,  shear,  bending  moment,  and 
torsion)  for  a  given  point  in  the  sky.  For  USAF  aircraft,  the  manufacturer  usually 
determined  the  external  loads  through  analyses,  wind  tunnel  testing  and  in-flight  strain 
surveys.  For  all  aircraft  except  the  F-4,  there  was  sufficient  confidence  in  the  existing 
data  to  perform  this  task.  The  USAF  elected  to  perform  a  flight  loads  survey  on  this 
aircraft  during  the  course  of  the  DTA.  This  turned  out  to  be  very  beneficial  because  the 
pre-existing  data  would  have  produced  a  pessimistic  view  of  the  maintenance  burden  for 
this  aircraft.  The  final  data  item  needed  for  the  generation  of  the  stress  spectra  is  the 
external  loads  to  stress  transformation.  For  all  of  the  aircraft  studied,  there  were  at  least 
some  experimentally  derived  stresses  from  previous  static  and  durability  tests.  However, 
in  all  cases  it  was  necessary  to  conduct  additional  stress  analyses.  The  contractor 
performed  these  additional  analyses  typically  using  the  finite  element  method.  The  scope 
of  this  finite  element  effort  ranged  from  evaluating  stresses  at  local  details  to  finite 
element  models  of  the  complete  airframe.  The  finite  element  effort  varied  significantly 
from  aircraft  to  aircraft  because  of  differences  in  the  test  database  and  the  complexity  of 
the  critical  details.  Simplification  of  the  stress  spectra  effort  would  have  been  possible  if 
direct  strain  measurements  had  been  available.  In  general,  these  data  were  not  available. 
In  a  few  cases,  such  as  the  C-5,  this  kind  of  information  was  available  and  was  invaluable 
for  determining  the  environment  from  maneuver,  turbulence,  and  aerial  refueling. 

The  techniques  used  in  deriving  the  stress  spectra  for  the  assessments  varied  quite  widely 
from  aircraft  to  aircraft.  Part  of  the  reason  for  this  difference  was  due  to  available 
database.  For  example,  for  the  F-4,  the  data  collected  from  the  VGH  recorder  provided 
the  number  of  occurrences  of  combinations  of  Mach  number,  load  factor,  and  altitude  in 
predetermined  bands.  Consequently,  the  assessment  of  areas  of  the  aircraft  sensitive  to 
asymmetrical  loading  required  data  from  other  aircraft  or  from  pilot  interviews.  For  the 
F-15,  however,  the  Signal  Data  Recorder  provided  a  time  history  of  both  symmetrical  and 
unsymmetrical  parameters  for  use  in  developing  the  stress  spectrum.  The  F-15  database 
more  accurately  accounted  for  the  unsymmetrical  loading.  Moreover,  it  permitted  a  more 
realistic  assessment  of  the  minimum  stress  excursion  that  followed  a  maximum  stress 
excursion.  For  the  F-4,  the  conservative  assumption  had  to  be  made  that  after  a  maximum 
stress  there  followed  either  a  stress  corresponding  to  one-g  flight  or  a  stress 
corresponding  to  less  than  one-g  flight.  The  database  on  the  F-15  enabled  the  analyst  to 
remove  this  conservatism. 

The  USAF  performed  all  of  the  fighter  and  attack  aircraft  assessments  by  reconstituting 
the  individual  flights  from  the  databases  except  for  the  F-lll.  For  this  aircraft,  the  multi¬ 
channel  recorder  data  was  used  directly  to  randomly  generate  a  "block"  of  flights  of 
approximately  500  hours.  This  is  a  very  effective  approach  if  one  can  be  sure  the  selected 
flights  are  representative  of  the  aircraft  usage.  For  the  F-lll,  they  used  the  counter  data 
for  load  factor  as  a  guide  for  this  selection.  There  was  no  attempt  made  to  maintain  the 
original  order  of  the  individual  flights  since  previous  studies  for  the  F-4  and  other  aircraft 
showed  sequence  effects  were  insignificant  if  the  flights  were  randomly  selected. 

As  indicated  earlier,  the  VGH  recorder  was  the  basis  for  the  F-4  usage  database.  A 
sampling  technique  based  on  VGH  recorder  data  provided  the  approach  for  the  derivation 
of  the  stress  exceedance  function.  In  this  method,  the  analyst  computed  the  stress  for  a 
representative  set  of  Mach  number,  load  factor,  weight,  and  altitude  combinations.  The 
surface  derived  from  the  representative  points  provided  the  means  to  determine  the  stress 
at  the  flight-measured  points.  Thus,  the  recorder  data  determined  the  stress  exceedance 
function  accounting  for  "all  points  in  sky.”  The  USAF  used  a  modification  of  this 
approach  in  the  development  of  the  stress  exceedance  function  for  the  A-7D  DTA.  For  the 
A-7D,  the  approach  involved  a  regression  equation  to  interpolate  based  on  the  stresses 
computed  for  a  representative  set  of  aircraft  flight  conditions. 


2-9 


The  environmental  data  that  augmented  the  flight  log  data  for  the  large  aircraft  were 
extremely  important.  The  USAF  refers  to  these  data,  used  in  the  ASIP,  as  the 
loads/environmental  spectral  survey  (L/ESS)  data.  It  provides  the  means  to  quantify  the 
three  dimensional  nature  of  wing  gust  loads,  the  phasing  of  shear  and  bending  moment, 
and  the  aerial  refueling  loads  on  the  C-5.  These  data  were  also  very  helpful  for  evaluating 
the  low-level  turbulence  on  the  B-52,  C-141,  and  C-130.  In  many  cases,  such  as  the  fire¬ 
fighting  mission  for  the  C-130,  special  mission  maneuver  data  needed  quantification.  It  is 
the  intent  in  the  derivation  of  the  stress  spectra  to  determine  the  "baseline  usage"  as  an 
average  usage  for  the  force.  For  aircraft  where  there  were  significant  usage  changes 
during  their  life  or  there  were  possible  changes  in  their  future  usage,  the  baseline  usage 
reflected  these  changes.  For  some  aircraft,  such  as  the  F-lll,  with  different  Mission 
Design  Series  (MDS),  the  USAF  derived  a  separate  baseline  usage  for  each  MDS.  In 
addition  to  the  baseline  usage,  there  is  a  need  to  derive  stress  spectra  that  represent 
potential  variations  from  the  baseline.  The  testing  of  these  variations  develops  confidence 
the  procedure  for  tail  number  tracking  by  fracture  mechanics  methods  is  valid.  For  the 
older  aircraft  assessments,  the  usual  procedure  was  to  define  a  spectrum  more  severe  than 
the  baseline  and  a  spectrum  less  severe  than  the  baseline.  Changing  the  baseline  mission 
mix  generally  accomplished  this. 

For  the  larger  tanker,  transport,  and  bomber  aircraft,  the  main  source  of  data  was  the 
flight  logs.  In  general,  these  logs  had  sufficient  detail  such  that  engineers  could  divide 
the  usage  among  a  relatively  few  missions  (of  the  order  of  ten).  Typically,  the  assessment 
had  to  include  two  or  more  distinct  usage  changes.  For  example,  for  the  B-52Gs  there 
were  differences  in  usage  prior  to,  during,  and  after  their  Southeast  Asia  operations.  In 
addition,  the  USAF  anticipated  the  usage  of  the  aircraft  in  the  future  to  be  different  from 
all  the  previous  usage. 

The  third  task  of  the  DTA  is  to  establish  the  initial  flaw  size  for  the  fracture  analysis. 
Because  of  their  inherent  stress  concentration,  fastener  holes  were  predominant  as 
candidates  for  critical  areas  of  the  airframe.  The  USAF  noted  there  had  not  been  a 
structural  failure  in  the  number  of  flights  it  takes  for  a  1.27  mm  corner  flaw  in  a  fastener 
hole  to  grow  to  critical  crack  length.  By  1975,  they  believed  there  was  sufficient  data  to 
make  the  judgment  that  this  size  was  sufficient  to  ensure  aircraft  safety.  They  derived 
this  belief  partially  from  teardown  inspections  of  full-scale  fatigue  test  aircraft,  but 
primarily  from  observing  operational  aircraft  such  as  the  F-4,  C-5A,  and  the  KC-135. 
There  has  never  been  a  rigorous  substantiation  of  this  belief.  However,  experience  in 
subsequent  years  supports  use  of  this  size  defect  as  being  adequate  to  protect  flight  safety. 
The  remaining  task  then  was  to  determine  the  flaw  size  for  holes  that  were  cold  worked  or 
filled  with  an  interference  fit  pin.  The  USAF  determined  this  flaw  size  on  ad  hoc  basis.  In 
some  cases,  where  there  was  a  question  of  the  adequacy  of  the  installation  of  the 
interference  fit  pins,  there  was  no  reduction  allowed.  In  other  cases,  where  there  was 
confidence  the  installation  was  proper,  the  USAF  reduced  the  initial  flaw  size  to  0.127 
mm.  The  primary  considerations  in  making  this  judgment  were  durability  test 
performance  and  manufacturing  procedures.  For  example,  the  C-141  durability  test 
showed  that  the  tapered  fasteners  did  extend  the  life  of  that  aircraft.  However,  there  was 
some  concern  about  the  quality  of  the  hand  held  drilling  operations  in  some  areas  of  the 
wing.  Consequently,  the  DTA  did  not  account  for  the  benefit  of  the  tapered  pins. 
However,  machines  with  controlled  feed  and  speed  drilled  many  of  the  wing  fastener 
holes.  For  these  holes,  the  USAF  made  a  decision  to  reduce  the  initial  flaw  by 
approximately  a  factor  of  two. 

The  identification  of  the  stress  spectra  for  each  critical  area  and  the  initial  flaw  permits 
the  initiation  of  the  task  of  establishing  operational  limits.  This  combined  analysis  and 
test  effort  uses  the  disciplines  of  fracture  mechanics  to  find  the  safety  limit  for  each 
critical  area.  The  fracture  mechanics  technology  has  improved  significantly  from  the 
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early  1970  period.  However,  even  with  the  analytical  capability  available  today,  the 
process  would  be  meaningless  without  test  substantiation. 

There  are  two  main  reasons  for  fracture  testing.  First  is  analysis  verification.  The  aim  is 
to  accomplish  this  with  the  least  specimen  complexity  possible  in  order  to  isolate  the  local 
detail  (e.g.,  a  fastener  hole)  and  evaluate  the  spectrum  retardation.  The  specimens  used 
for  this  purpose  were  generally  dog  bone  specimens  with  the  proper  material,  thickness, 
size  of  fastener,  and  load  transfer.  The  second  reason  for  testing  is  to  establish  high  and 
low  side  truncation  levels.  The  low  side  truncation  is  primarily  an  economic 
consideration.  The  object  is  to  eliminate  as  many  cycles  as  possible  with  a  small  stress 
range  without  significant  change  in  the  crack  growth.  The  removal  of  the  high  stresses  (or 
clipping)  eliminates  those  cycles  that  make  a  crack  grow  slower  and  retain  those  which 
make  a  crack  grow  faster. 

In  the  early  1970  period,  there  was  a  belief  that  crack  growth  was  quite  sensitive  to  the 
loading  sequence  within  a  flight.  Therefore,  as  part  of  the  DTA,  the  USAF  required  tests 
to  evaluate  these  effects.  It  was  learned  that  if  they  simulated  loading  on  a  flight-by- 
flight  basis,  then  the  ordering  of  loads  within  a  flight  was  of  secondary  importance. 
Consequently,  they  discontinued  this  type  testing.  For  almost  all  of  the  aircraft,  the  fact 
that  the  critical  crack  sizes  were  sufficiently  small  such  that  there  was  little  if  any 
redistribution  of  stresses  during  crack  growth  simplified  the  fracture  analysis.  Further, 
the  primary  structural  issue  was  crack  growth  from  a  fastener  hole  or  an  open  hole. 
Therefore,  the  analyst  needed  to  concern  himself  with  the  part  through  flaw  in  mode  I 
cracking  from  both  filled  and  unfilled  holes,  load  transfer  on  the  fasteners,  and  retardation 
effects.  For  simulating  the  retardation  effects,  the  analysts  generally  used  the  Wheeler 
model,  the  Willenborg,  the  modified  Willenborg,  or  some  form  of  a  contact  stress  model. 
The  T-38  analysis  used  the  Vroman  model  for  part  of  its  DTA.  This  model  was  not  used 
for  any  other  assessment. 

Analysts  learned  that  proper  counting  of  the  stress  cycles  in  the  spectrum  was  essential 
for  obtaining  accuracy.  The  so-called  rain  flow  procedure  is  now  commonly  accepted  as 
an  adequate  procedure  for  counting  the  stress  cycles  in  the  spectrum  [30]. 

After  the  verification  of  the  crack  growth  analytical  model  through  coupon  and  in  some 
cases,  component  testing,  the  effects  of  the  chemical  environment  entered  the  analysis 
process.  For  the  early  assessments,  the  tendency  was  to  take  a  conservative  view  of  the 
environment.  That  is,  the  USAF  required  the  selection  of  an  environment  more  aggressive 
with  respect  to  crack  growth  than  actually  expected.  This  position  was  relaxed  in  the  late 
1970s  and  they  placed  emphasis  on  selecting  a  realistic  environment.  Constant  amplitude 
crack  growth  tests  performed  in  the  desired  environment  provide  the  basis  for  the 
quantification  of  these  effects.  The  crack  growth  analysis  includes  the  environmental 
effect  in  the  data  used  for  the  crack  growth  rates.  The  procedure  is  subject  to  criticism 
because  it  may  not  accurately  account  for  the  effects  of  cyclic  frequency  and  load 
interaction  effects  with  the  environment.  There  is  no  indication  from  the  inspections 
performed  on  operational  aircraft  the  error  is  significant. 

The  crack  growth  analysis  plays  a  dominant  role  in  damage  tolerance  approach.  The  tool 
must  be  usable  for  different  chemical  as  well  as  loading  environments.  In  other  words,  it 
is  the  mechanism  for  tracking  the  crack  growth  on  each  tail  number  in  the  force  and 
thereby  ensuring  aircraft  safety.  Therefore,  it  is  extremely  important  to  validate  the 
analysis  for  the  expected  range  of  service  operations.  After  the  analyst  establishes  the 
safety  limits  for  all  the  critical  areas  of  the  structure,  the  development  of  the  Force 
Structural  Maintenance  Plan  (FSMP)  can  proceed.  The  FSMP  provides  the  how,  when,  and 
where  for  structural  inspections  or  the  when  and  where  for  modifications.  In  many  cases, 
it  was  found,  based  on  either  economic  or  safety  considerations,  that  modifications  were 
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preferable  to  continued  inspections.  This  situation  existed  for  the  C-5,  T-38,  F-4,  and 
KC-135,  for  example.  Of  course,  the  DTA  process  should  include  the  modifications. 

One  of  the  more  important  tasks  in  the  damage  tolerance  approach  was  to  establish  the 
NDI  capability.  This  was  done  with  the  help  of  the  NDI  experts  from  the  now  Air  Force 
Research  Laboratory  (AFRL)  Materials  Directorate,  the  appropriate  Air  Logistics  Center 
(ALC),  and  the  contractor.  In  some  cases,  such  as  the  EF-111,  they  conducted  an  NDI 
reliability  program  to  determine  the  flaw  size  corresponding  to  90  percent  probability  of 
detection  with  95  percent  confidence.  However,  these  cases  were  in  the  minority  and, 
consequently,  the  USAF  based  most  of  the  NDI  detection  capability  on  judgment.  When 
possible,  they  avoided  inspections  that  involved  removal  of  fasteners.  In  addition,  the 
USAF  rejected  the  concept  of  sampling  inspections  rather  than  inspecting  100  percent  of 
the  force. 

The  FSMP  covered  the  period  of  the  planned  operational  usage  of  the  aircraft.  Thus,  the 
FSMP  permitted  the  ASIP  manager  at  the  ALC  to  determine  the  out  years  maintenance 
cost.  The  accuracy  of  these  costs  was  suitable  for  budgetary  estimates.  The  accuracy  for 
any  given  tail  number  is;  of  course,  dependent  on  how  closely  that  aircraft  flies  to  the 
baseline. 

USAF  structural  engineers  have  long  recognized  the  need  for  tail  number  tracking  of 
aircraft.  This  is  evident  from  the  emphasis  given  to  it  in  the  1959  version  of  ASIP.  The 
only  significant  change  from  the  original  version  is  the  tracking  process  is  for  crack 
growth  rather  than  fatigue  damage.  The  USAF  developed  the  first  tracking  program  based 
on  fracture  for  the  F-4  during  its  DTA.  Now  all  aircraft  that  have  had  a  DTA  have  a 
tracking  program  based  on  fracture  mechanics.  For  many  of  these  aircraft,  the  ASIP 
manager  has  the  computer  programs  to  provide  an  immediate  view  of  the  maintenance 
status  of  his  aircraft.  This  provides  him  with  both  near  and  far  term  planning  and  decision 
making  capability.  It  provides  him  with  the  capability  to  determine  the  consequences  of  a 
mission  change.  There  is  also  a  need  for  commercial  aircraft  to  have  a  periodic 
reassessment  of  their  usage.  The  availability  today  of  excellent  digital  recording  devices 
has  made  this  task  considerably  more  manageable  than  in  the  past. 

The  damage  tolerance  approach  has  led  to  a  greatly  improved  understanding  of  aircraft 
structures  and  their  performance.  It  is  the  foundation  for  maintaining  flight  safety  in 
aging  aircraft.  It  has  also  led  to  a  greater  recognition  that  additional  research  and 
development  in  the  areas  of  materials,  structures,  and  nondestructive  evaluation  were  not 
only  needed,  but  could  further  increase  the  reliability  of  systems.  Consequently,  over  the 
last  several  years,  many  programs  have  focused  themselves  on  increasing  the  knowledge 
base  available  to  enable  longer  lives  and  more  reliability  from  airframes  and  engines. 
Overall,  the  damage  tolerance  experience  has  been  good.  The  criticism,  which  is  rare,  has 
come  from  people  who  believe  the  approach  is  too  conservative  when  they  perform  an 
inspection,  and  find  no  cracks.  On  the  other  hand,  the  DTA  process  has  correctly  directed 
inspections  to  areas  that  full-scale  testing  did  not  indicate  they  were  critical.  Figure  3 
shows  the  DTAs  performed  by  the  USAF  during  the  seventies  and  eighties. 
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Figure  3  Damage  Tolerance  Experience  in  the  USAF 


Conclusions 

Operational  aircraft  failures  from  fatigue  in  the  fifties  and  sixties  motivated  a 
fundamental  change  in  the  approach  for  ensuring  safety  of  flight  for  aircraft.  In  the 
seventies,  many  certification  authorities  endorsed  the  damage  tolerance  process  for  design 
and  maintenance  of  safety  critical  structure.  The  process  uses  stress  analyses,  loads 
analyses,  and  fracture  mechanics  to  determine  inspection  intervals  or  modification  times 
to  the  in-service  maintenance  program.  This  disciplined  process  has  proven  to  be 
successful  in  preventing  structural  failures  from  fatigue. 
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Introduction 


Today,  47  airforces  are  operating  more  than  6000  engines  sold  by  Snecma  or  by  CFMI,  the  joint 
company  (50/50)  of  Snecma  (France)  and  GE  (USA)  -  (figl). 

Snecma  Military  Customer  &  Operator  Base _ 


PORTUGAL 


Among  those  engines,  some  have  been  operated  for  more  than  30  years  (fig. 2). 

SNECMA  Military  Engine  Experience  (as  of  December  31st,  1999) 


ENGINE 

AIRCRAFT 

ENGINES 

IN  SERVICE 

OPERATORS  SERVICE 

EXPERIENCE 

•  Aiar08/09K50 

Super  Etendard,  Mirage  FI,  50, 
Cheetah,  Pantera 

842 

14 

1,870,680  h 

•  Other  Atar 
(08C/09B/09C/09K) 

Etendard, 

Mirage  III,  IV,  V 

768 

14 

4,126,240  h 

•  Tyne 

Transall, 

Atlantic  1 ,  Atlantique  2 

838 

9 

5,798,510  h 

•  Larzac 

Alphajet,  MiG-AT 

1,129 

12 

2,665,675  h 

•  M53 

Mirage  2000 

620 

8 

781,616  h 

•  CFM56-2A/-2B/-2C 

E3,  KE3,  E6, 

C135FR,  KC135R,  DC8-72 

2,018 

7 

7,480,000  h 

•  CFM56-3 

B737-300  *(12-31-1998) 

13* 

3* 

78,000  h* 

TOTAL 

22 

6,228 

47 

22,800,721  h 

EVERY  MINUTE, 

A  SNECMA  MILITARY 

ENGINE 

TAKES 

OFF 

=Sp)  Snecma  Moteurs 

aroune  snecma 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 


Snecma’ s  target  is  to  have  all  our  customers  satisfied.  Therefore,  we  have  developed  a  philosophy  of 
product  and  service  continuous  improvement,  covering  in  in  particular: 

•  Life  extension  and  maintenance  cost  reduction  programs. 

•  Modification  proposals  triggered  by  mission  profile  evolution. 

•  Better  of  involvement  of  customers  national  industry  (fig  3). 


Snecma  Moteurs  Industrial  Cooperation  Network 

A  Tradition  in  an  Ever  Changing  World 


Snecma  Moteurs 

snecma  group 


The  following  paragraphs  of  this  paper  will  explicit  how  those  principles  have  been  implemented  on 
the  ATAR  engine  program  between  Snecma  and  the  operators. 


The  Snecma  commitment. 

-  ATAR  9C  engines  are  installed  on  Mirage  3  s  and  Mirage  5  s 

-  ATAR  9K50  are  installed  on  Mirage  FI  and  Mirage  50. 

The  present  operators  base  (fig  4)  includes  a  large  number  of  operators  with  limited  resources  and 
who  have  planned  to  operate  the  engines  up  to  2020. 


Snecma  is  committed  to  support  the  ATAR  customers 
until  the  end  of  service  of  the  ATAR  engines . 
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A  WIDE  ATAR  OPERATORS  BASE  (as  of  January  1st,  2000) 


The  traditional  way  to  maintain  ATAR  engines  is  to  send  the  complete  engines  to  the  Depot  Level 
maintenance  shop  once  the  operating  life  limit  has  been  reached  and  then  perform  the  DLM  overhaul 
and  repair. 

This  scheme  fits  well  the  needs  of  large  fleet  operators.  However,  it  was  found  a  little  too  expensive 
by  some  operators  with  smaller  fleets  and  more  limited  resources.  This  is  the  reason  why  Snecma  has 
developed  the  following  tools: 

-  Long  term  support  contracts 

-  Modular  maintenance 

-  Second  hand  hardware  availability. 

-  Standard  exchange  instead  or  repairs. 

3.  The  ATAR  Plus  program 

France,  South  Africa  and  Spain  have  jointly  determined  that  one  of  the  ways  to  limit  ATAR  9K50 
maintenance  costs  was  to  introduce  a  series  of  modifications  known  as  the  “ATAR  Plus”  program, 
including 

-  Compressor  OGV  upgrade  (fig. 5) 

-  HP  turbine  NGV  upgrade  (fig. 6) 
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08K50  &  09K50  Engine  Improvement 
OGV  -  Mechanical  behaviour  improvement 


PRESENT  VERSION 


-Material  :Z6CNT18 
-  Hammered  vanes 


FUTURE  VERSION 


-  Material  :  NC  19  Fe  Nb  (Inco  718) 

-  Vanes  brazed  all  around 


(AgCuZnCd  630  repair  brazing) 


(Ni  Pd  Cr  B  980) 

•  Better  mechanical  characteristics 


Snecma  Moteurs 


snecma  group 


08K50  &  09K50  Engine  Improvement 
IGV  -  Mechanical  behaviour  improvement 

PRESENT  VERSION 


FUTURE  VERSION 


With  unchanged  : 

-  Interface 

-  Aerodynamics 

-  Cooling  system 


XX  SECTION 


Z10  CNW  17  integral  ring  - 


Snecma  Moteurs 

snecma  group 


The  ATAR  Plus  program  has  been  launched  by  a  consortium  of  three  companies: 

-  Snecma  (France) 

-  Industria  de  Turbopropulsores  (Spain) 

-  Denel  Aviation  (South  Africa) 


and  is  now  entering  production. 
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4.  Long  term  support  Contracts  Initiative 

Cost  limitation  implies  cost  control. 

Snecma  has  identified  the  need,  voiced  by  some  customers,  to  have  a  complete  support  contractual 
package  based  on  the  following  principles: 

•  The  operator  performs  maintenance  operation  only  at  the  airfield  location. 

•  Snecma  Moteurs  performs  all  the  rest  of  the  engine  maintenance  and  support  on  a  design  to  cost 
basis. 

This  leads  to  contracts  between  Snecma  and  the  customers  with  the  following  typical  features: 

-  Time  of  the  contractual  package  :  5  years 

-  Fixed  yearly  price  for  general  support  (engine,  test  cell,  GSE)  and  Technical  assistance  -  training  - 
documentation. 

-  Snecma  commitment  to  maximize  the  involvement  of  the  customer’s  national  industry. 


5.  Modular  maintenance. 

ATAR  engines  family  was  designed  between  1946  and  1960s  at  a  time  where  performance  was  found 
more  important  than  cost  and  particularly  maintenance  cost. 

The  engine  maintenance  could  be  split  into  modules  only  at  the  Depot  Level. 

Some  years  ago,  Snecma  has  proposed  to  some  customers  to  split  the  engines  into  modules  (fig.7)  at 
the  airfield  level  in  order  to: 

-  Improve  drastically  the  engine  availability  in  the  fleet 

-  Reduce  the  overall  maintenance  cost  by  about  30  %. 

ATAR  9K50  /  Modular  Maintenance 


□  The  ATAR  09K50  is  broken  down  into  Overhaulable  Sub-Assemblies 
(OSA)  which  are  interchangeable  as  far  as  their  dimensions  and 
operation  are  concerned 


□  There  are  23  structural  sub-assemblies,  4  sub-assemblies  for  equipment 
parts  and  93  accessories  included  in  the  sub-assemblies  but  which  may 
be  replaced  individually 


Main  Sub-Assemblies 


ea-Mi 


>A-9K50-McD-06/00-VI\ 


Snecma  Moteurs 

snecma  group 
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6.  Second  hand  hardware  Resources 

French  Air  Force  has  progressively  retired  its  Mirage  3  and  ATAR  9C  in  the  1980s  time  period. 

A  large  number  of  modules  and  parts,  either  stored  but  not  used,  or  operated  for  a  certain  time,  but 
still  with  an  interesting  life  time  have  become  available. 

Snecma  has  installed  recently  a  “ATAR  Second  Hand  Resource  Center”  (fig. 8). 


HOW  IT  WORKS 


Snecma  Moteurs 

snecma  group 


SLC-  031-99  /  2 


Snecma  regularly  publishes  the  list  of  the  available  second  hand  parts  and  modules  and  when  a 
request  for  proposal  is  received  at  Snecma,  the  response  mostly  includes  a  mix  of  new  parts  and 
second  hand  parts. 

This  approach  allows  the  customer  to  optimize  its  ownerships  cost  of  the  parts,  while  maintaining  a 
high  level  of  quality  on  its  engines  since 


Snecma  grants  any  second  hand  hardware  the  same  level  of  quality 
and  guarantee  than  the  one  granted  for  new  parts 


7.  Standard  exchange  vs  repair  approach 

The  availability  of  low  cost  engine  modules  with  an  interesting  remaining  life  time  (paragraph  6) 
allows  Snecma  and  customers  to  consider  module  standard  exchange,  at  a  cost  substantially  lower 
than  a  module  repair. 

This  standard  exchange  can  be  done  either  at  the  airfield  level  or  at  the  Depot  Level,  according  to  the 
customer’s  choice. 


In  any  case,  Snecma  supports  the  customer  and  is  assisting  him  in  the  implementation  of  his  decision. 
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8.  Critical  parts  management 

Second  hand  hardware  allows  to  reduce  maintenance  costs,  but  all  the  customer’s  needs  are  not 

fulfilled  by  to  second  hand  parts. 

Some  ATAR  parts  still  need  to  be  manufactured  by  Snecma  and  subcontractors. 

As  the  manufacturing  quantities  are  declining,  manufacturing  prices  are  rising. 

Because  Snecma  wants  to  have  ATAR  operators  satisfied  until  the  end  of  their  operation,  we  have 

initiated  a  Critical  Parts  Management  dialogue  with  our  customers  as  follows: 

Step  1  :  The  operators  have  provided  Snecma  their  critical  parts  needs  evaluation  covering  operations 
until  the  end  of  their  ATAR  operation. 

Step  2  :  On  this  basis,  Snecma  has  issued  a  preliminary  possible  critical  parts  production  plan 
explaining  what  parts  are  likely  to  stay  on  the  production  line. 

Step  3  :  Snecma  will  issue  last  batch  production  offers  including  prices,  schedule  and  launching 
conditions. 

Step  4  :  For  the  parts  where  launching  conditions  are  met,  Snecma  will  launch  critical  parts  last 
batches  manufacturing  and  subsequent  deliveries. 


This  page  has  been  deliberately  left  blank 


Page  intentionnellement  blanche 
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REPAIR  OPTIONS  FOR  AIRFRAMES 

Mohan  M.  Ratwani,  Ph  D. 
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28441  Highridge  Road,  Suite  530,  Rolling  Hills  Estates,  CA  90274-4874,  USA 
Tel.  (310)  378-9236,  Fax.  (310)  378-7697,  E-mail-  MohanR@AOL.com 


1.  INTRODUCTION 

Maintaining  the  airworthiness  of  in-service  aircraft  and  at  the  same  time  keeping  the  maintenance  cost  low  is  of  prime 
concern  to  the  operators  and  regulatory  authorities.  In  order  to  keep  maintenance  cost  low,  right  decisions  need  to  be  made 
regarding  replacing  or  repairing  the  in-service  damaged  components.  The  choice  between  replacing  or  repairing  a 
structural  component  is  governed  by  a  number  of  factors  such  as  the  availability  of  spares,  duration  a  stmctural 
component  is  expected  to  be  in  service,  feasibility  of  repair,  repair  meeting  structural  integrity  requirements,  and 
inspection  requirements  for  the  repair.  If  it  is  economical  to  repair  the  component  then  the  optimum  repair  design  needs  to 
be  selected. 

This  paper  discusses  structural  life  enhancement  techniques  along  with  the  state-of-practice  methods  of  repairing  metallic 
and  composite  structures.  Applications  of  advanced  repair  methods  such  as  composite  patch  repair  of  cracked  metallic 
structures  are  discussed.  Available  computer  codes  for  designing  repairs  are  briefly  described. 

2.  STRUCTURAL  LIFE  ENHANCEMENT  OPTIONS 

Stress  levels,  load  spectrum,  environment,  structural  details  and  the  material  of  the  structural  component,  govern  the  life 
of  an  aircraft  structure.  Under  certain  loading  and  environmental  conditions  a  crack  may  initiate  and  propagate  in  a 
metallic  structural  component  or  environmental  conditions  may  cause  severe  corrosion  in  the  component.  Depending  on 
the  stmctural  details,  the  crack  or  corrosion  damage  may  result  in  a  catastrophic  failure  or  costly  repairs.  A  logical 
preventive  method  is  to  retard  the  initiation  and  growth  of  the  cracks  by  pre-stressing  so  that  the  cracks  do  not  result  in 
catastrophic  failure  before  the  useful  life  of  the  structure.  In  certain  cases  this  may  not  be  feasible  and  a  structure  may 
have  to  be  repaired  to  meet  the  useful  life  requirements.  In  addition,  the  in-service  damage  due  to  foreign  objects  in  both 
metallic  and  composite  structures  frequently  requires  repairs  so  that  the  structure  is  able  to  carry  the  required  load.  Two 
commonly  used  techniques  of  stmctural  life  enhancement  (Reference  1)  by  prestressing  and  repairs  are  summarized  in 
Figure  1. 


Figure  1.  Life  Enhancement  Techniques 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects”,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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Prestressing  techniques  to  enhance  structural  life  are  generally  used  before  a  problem  has  occurred.  In  the  design  and 
analyses  process,  if  a  component  or  some  parts/areas  of  a  component  are  not  able  to  meet  design  life  requirements, 
prestressing  process  may  be  used  for  these  locations  to  meet  service  life  requirements.  In  case  of  in-service  aircraft,  if  fleet 
data  indicates  cracking  problems  in  certain  areas,  these  areas  may  be  subjected  to  prestressing  process  to  enhance  life 
before  cracks  initiate. 

Life  Enhancement  Through  Pre-stressing  Techniques 

In  this  technique  a  residual  compressive  stress  field  is  created  at  highly  stressed  locations  such  as  holes  where  cracks  are 
likely  to  initiate.  Subsequent  inflight  loads  have  to  overcome  the  compressive  stresses  in  order  for  the  cracks  to  initiate 
and  propagate.  Some  prestressing  techniques  have  been  fully  developed  while  others  are  still  in  the  development  stage  and 
have  shown  good  promise  to  enhance  structural  life.  The  applications  of  these  techniques  to  in-service  aircraft  are  shown 
in  Figure  2.  The  figure  also  shows  the  locations  where  these  techniques  are  applied  (e.g.  whether  the  technique  can  be 
used  at  the  manufacturing  line,  depot  or  field).  The  analysis  methodology  that  can  be  used  for  life  predictions  is  also 
shown  in  the  figure.  The  level  of  verification  testing  required  for  successfully  implementing  the  technique  is  also  given  in 
the  figure.  The  extent  of  life  enhancement  achieved  through  these  techniques  is  discussed  in  Reference  1. 


PRE-STRESSING 

IN-SERVICE 

LOCATION  WHERE 

ANALYSES 

REQUIRED 

TECHNIQUE 

APPLICATIONS 

PERFORMED 

METHODS 

TESTING 

COLD  WORKING 

T-38,  F-5,  F-16,  JSTARS 

MANUFACTURING  LINE, 

EQUIVALENT 

MINIMUM 

F-18,  F- 111,  C-141,  747 
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Figure  2.  Prestressing  Life  Enhancement  Techniques  Applications 

Life  Enhancement  Through  Repairs 

Structural  life  enhancement  techniques  through  repairs  for  in-service  fatigue,  corrosion  and  foreign  object  damage  (FOD) 
have  been  well  established  for  metallic  aircraft.  With  the  increasing  use  of  composites  for  improved  structural  efficiency, 
these  methods  have  been  developed  for  composite  materials.  However,  there  are  basic  differences  between  the  damage 
types  and  their  behavior  in  composite  and  metallic  materials  (Ref.  2-4).  The  basic  differences  between  the  behavior  of 
metals  and  composites  need  to  be  understood  so  as  to  design  proper  repairs  for  metallic  and  composite  structures.  Figure  3 
shows  a  comparison  of  typical  metal  and  composite  fatigue  behavior  under  fighter  aircraft  wing  spectrum  loading.  The 
data  are  plotted  for  each  material’s  most  sensitive  fatigue  loading  mode,  which  is  tension-dominated  (lower  wing  skin)  for 
metals  and  compression-dominated  (upper  wing  skin)  for  composites.  The  figure  shows  that  composite  fatigue  properties 
are  far  superior  to  those  of  metal. 
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Figure  3.  Comparison  of  Fatigue  Behavior  of  Metallic  and  Composite  Materials 

A  major  consideration  in  the  design  of  composite  structures  is  the  in-service  impact  damage.  Impact  damage  occurs 
during  ground  handling,  take-off  and  landing,  and  in-flight  due  to  foreign  objects.  Hard  objects  (e.g.  tool  drops  and 
runway  debris)  may  cause  impact  damage  and  soft  objects  (e.g.  bird  impacts  that  occur  at  low  altitude  during  take-off  and 
landing).  The  impact  damage  caused  by  tool  drops,  etc.  is  termed  as  low  velocity  damage.  Considerable  reduction  in 
compression  strength  may  occur  due  to  low  velocity  damage  that  is  not  visually  detectable  on  the  impacted  or  other 
external  surfaces.  The  non-visual  damage  may  cause  internal  damage  in  the  form  of  delaminations  between  plies,  matrix 
cracking,  and  fiber  breakage.  The  longitudinal  cross-section  of  an  impact-damaged  panel  is  shown  in  Figure  4.  The 
damage  due  to  impact  is  influenced  by  the  factors  such  as  laminate  material  properties,  size  of  the  laminate,  support 
conditions,  substructure,  impactor  size  and  shape,  impactor  velocity,  impactor  mass,  impact  location,  and  environment 
(Reference  5). 


Impact  Location 


Figure  4.  Impact  Damage  in  Composites 
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Experimental  data  have  shown  (Figure  5)  that  impact  damage  can  cause  significant  loss  in  strength.  The  degradation  in 
compression  strength  is  more  severe  than  tension  strength  due  to  the  delaminations  between  the  plies  caused  by  the  impact 
damage  (Reference  4). 


Figure  5.  Strength  Degradation  Caused  by  Impact  Damage 


3.  DAMAGE  EVALUATION  AND  REPAIR  CONCEPT  SELECTION 

The  first  step  in  designing  any  repairs  is  to  evaluate  the  extent  and  nature  of  damage.  Commonly  occurring  in-service 
damages  in  metallic  and  composite  structures  are  shown  in  Figure  6.  The  overall  process  involved  in  damage  evaluation 
and  making  repair  decisions  for  a  metallic  and  composite  structure  is  outlined  in  Figure  7.  Once  the  nature  and  extent  of 
damage  is  found  it  is  important  to  determine  the  effect  of  damage  on  structural  integrity.  If  in  a  metallic  structure,  the 
damage  found  is  a  small  crack  that  is  much  smaller  than  critical  crack  length,  the  repair  may  be  performed  by  enlarging 
the  hole  to  remove  the  crack  and  using  an  oversize  fastener.  In  such  cases,  a  revised  damage  tolerance  analysis  needs  to  be 
performed  and  new  inspection  requirements  imposed  for  that  location. 
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Composite  Structures 

Fatigue  Cracks 

Delaminations 

Corrosion 

Impact  Damage 

Stress  Corrosion 

Foreign  Object  Damage 

Foreign  Object  Damage 

Figure  6.  In-service  Damage  Types  in  Metallic  and  Composite  Structures 

The  type  of  repair  to  be  performed  will  be  determined  by  the  following  factors- 

1 .  Type  of  structural  material  to  be  repaired  (metal,  composite,  sandwich  construction) 

2.  Type  of  structural  component  to  be  repaired  (skin,  spar,  rib,  longeron,  etc.) 

3.  Type  and  extent  of  damage  (e.g.  fatigue  cracks,  corrosion,  impact  damage,  etc.) 

4.  Load  levels  and  fatigue  spectrum  experienced  by  the  structure 

5.  Material  thickness  to  be  repaired 

6.  Skill  of  the  available  labor 

7.  Availability  of  repair  materials 

8.  Repair  facility 
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Figure  7.  Damage  Evaluation  and  Selection  of  Repair  Methods 


4.  REPAIR  OPTIONS 

4.1  Repair  of  Composite  Materials 


Repairs  of  composite  materials  are  similar  to  those  for  metallic  materials  if  mechanically  fastened  repairs  are  to  be  used. 
However,  the  repairs  of  composite  materials  are  different  from  those  of  metals  if  the  repairs  are  to  be  bonded.  The  damage 
must  be  evaluated  and  classified.  If  the  damage  is  repairable,  a  decision  has  to  be  made  whether  to  repair  or  replace  a  part. 
If  the  structure  is  to  be  repaired,  additional  decisions  have  to  be  made  regarding  maintenance  level,  where  work  will  be 
done,  kind  of  repair  materials,  and  repair  configuration.  The  first  step  in  the  repair  of  composite  materials  is  to  remove  the 
damage  area  including  the  delaminated  area  in  the  impacted  region.  The  next  step  is  to  clean  the  surface  to  be  repaired  and 
apply  a  bolted  or  bonded  patch.  These  repair  concepts  are  discussed  in  the  following  paragraphs. 

BOLTED  REPAIRS 


Bolted  repairs  for  composite  structures  are  similar  to  those  for  metallic  structures.  The  major  differences  between  the 

repairs  for  composites  and  metals  are: 

a)  Different  tools  are  used  for  drilling  fastener  hole  in  composites. 

b)  Special  care  is  needed  in  drilling  holes  in  composites  to  prevent  splintering  on  the  exit  side  of  the  hole.  A  back  support 
is  desirable. 

c)  Matrix  in  composite  is  brittle  compared  to  metal,  hence  the  fasteners  that  expand  to  fill  the  hole  (e.g.  driven  rivets)  are 
not  suitable  for  composites. 

d)  Sharing  of  loads  in  different  fasteners  in  composites  is  not  uniform  because  composite  materials  do  not  yield  as  metals 
where  the  load  distribution  tends  to  be  more  uniform. 

Three  commonly  used  bolted  repair  concepts  are  shown  in  Figure  8  and  are  discussed  here. 
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Figure  8.  Bolted  Repair  Concepts 


External  Patch  with  Backup  Plate-  This  concept  uses  an  external  chamfered  metal  patch  bolted  to  the  panel  being 
repaired  as  shown  in  Figure  8.  The  bolts  thread  into  nut  plates  mounted  on  metal  backup  plates  that  are  on  the  side  of  the 
repaired  panel.  The  backup  plate  can  be  split  into  two  or  more  pieces  and  slipped  through  the  opening  as  shown  in  the 
figure. 

External  Patch  with  Blind  Fasteners-This  concept  is  similar  to  the  previous  one,  except  that  the  backup  plates  are  not 
used  as  shown  in  Figure  8.  Blind  fasteners  are  not  as  strong  as  bolts  and  nutplates,  but  if  acceptable  strength  can  be 
restored,  this  concept  is  easier  to  use. 


Bolted  Internal  Doubler-This  concept  has  been  used  as  a  standard  repair  for  metal  structures.  Access  to  the  backside  is 
required  to  install  the  doubler  as  shown  in  Figure  8.  The  doubler  cannot  be  installed  through  the  hole  as  a  separate  piece 
because  the  doubler  has  to  be  continuous  to  carry  loads  in  all  directions.  Filler  is  used  to  provide  a  flush  outer  surface,  and 
is  not  designed  to  carry  loads. 


BONDED  REPAIR  CONCEPTS 

Bonded  repair  concepts  can  restore  greater  strength  to  a  damaged  composite  structure  as  compared  to  bolted  repairs. 
External  repair  patches  are  suitable  for  thin  skins,  however,  for  thick  skins  the  eccentricity  of  the  external  patch  reduces  its 
strength.  Flush  patches  are  preferred  for  thick  structures,  heavily  loaded  structures,  or  where  aerodynamic  smoothness  is 
required.  Commonly  used  repair  concepts  are  step-lap  and  scarf  repairs. 

Step-Lap  Repair-  This  repair  concept  is  shown  in  Figure  9.  The  steps  allow  the  load  to  be  transferred  between  specific 
plies  of  the  patch  and  parent  material.  This  advantage  tends  to  increase  the  strength  of  the  joint;  however,  it  is  offset  by  the 
peaks  that  exist  in  the  adhesive  shear  stress  at  the  end  of  each  step. 
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Figure  9.  Step-Lap  Repair 


Scarf  Repair-  This  repair  concept  is  shown  in  Figure  10.  The  patch  material  is  within  the  thickness  to  be  repaired,  with 
additional  external  plies  added  for  strength.  This  configuration  can  restore  more  strength  than  an  external  patch  as  it 
avoids  the  eccentricity  of  the  load  path  and  provides  smooth  load  transfer  through  gradually  sloping  scarf  joint.  A 
properly  designed  scarf  joint  can  usually  develop  the  full  strength  of  an  undamaged  panel.  The  patch  material  is  usually 
cured  in  place,  and  therefore  must  be  supported  during  cure.  While  the  patch  material  can  be  cured  and  then  later  bonded 
in  place,  it  is  generally  difficult  to  get  a  good  fit  between  the  precured  patch  and  the  machined  opening.  In  practice,  well- 
made  step-lap  and  scarf  joints  have  approximately  the  same  strength.  A  disadvantage  of  step-lap  joints  is  the  difficulty  in 
machining  the  step  to  the  depth  of  the  exact  ply  that  is  desired  on  the  surface  of  the  step. 
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Figure  10.  Scarfed  Repair 
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4.2  Repair  of  Sandwich  Structures 

A  typical  in-service  damage  to  a  sandwich  structure  with  composite  face  sheets  is  shown  in  Figure  11.  The  damage  to 
composite  face  sheets  is  visible  damage  with  surface  indentation.  Delaminations  are  seen  in  the  composite  face  sheets  as 
well  as  disbonding  between  the  face  sheets  and  honeycomb  core.  In  addition,  core  buckling  is  seen. 


HONEYCOMB  CORE 


CORE  BUCKLING 


Figure  11.  Typical  Impact  Damage  in  Sandwich  Structure  with  Composite  Face  Sheets 
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The  repair  of  a  sandwich  structure  will  depend  on  the  extent  of  the  core  damage.  Full  depth  and  partial  through  the  depth 
repair  concepts  are  shown  in  Figure  12.  The  core  damage  has  to  be  machined  out  and  a  plug  prepared  before  performing 
the  repairs.  Various  steps  involved  in  the  repair  are  illustrated  in  the  figure. 
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Figure  12.  Repair  Concepts  for  Sandwich  Structure  with  Composite  Face  Sheets 


4-9 


4.3  Repair  of  Metallic  Structures 

4.3.1  MECHANICALLY  FASTENED  REPAIRS  OF  METALLIC  STRUCTURES 

Repair  concepts  for  metallic  structures  are  well  established.  The  bolted  repair  concepts,  discussed  earlier  for  composites 
are  applicable  to  metallic  repairs.  Standard  repairs  are  generally  given  in  repair  manuals.  However,  in  many  cases  in- 
service  inspections  show  damages  that  are  not  covered  by  standard  repair  manuals  and  special  repairs  have  to  be  designed. 
For  such  cases  detailed  static  and  damage  tolerance  analyses  have  to  be  carried  out.  An  example  of  cracked  frame  in  a 
transport  aircraft  (Figure  13)  is  shown  in  Figure  14.  The  flange  and  the  web  of  the  frame  are  cracked  as  shown  in  Figure 
15a.  Standard  repair  manuals  generally  do  not  cover  a  repair  for  the  damage  shown  in  Figure  14.  The  cross-sections  of  the 
flange  and  web  repairs  are  shown  in  Figure  15b.  The  details  of  the  frame  repair  are  shown  in  Figure  16. 


Figure  13.  Cracking  Location  in  Transport  Aircraft  Fuselage 
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Figure  14.  Cracked  Frame 
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Figure  15a.  Cross-section  of  Cracked  Frame  Figure  15b.  Cross-section  Showing  Flange  and  Web  Repair 


Figure  16.  Details  of  Frame  Repair 
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4.3.2  BONDED  REPAIRS  OF  METALLIC  STRUCTURES 

The  conventional  mechanically  fastened  repair  concept  has  disadvantages  primarily  due  to  the  drilling  of  holes  for 
additional  fasteners  that  affect  the  structural  integrity  of  the  structure.  In  many  cases  the  parts  have  to  be  scrapped  due  to 
the  repaired  structure  not  meeting  the  fail  safety  requirements.  In  most  cases  if  the  thinning  due  to  corrosion  is  more  than 
10%  of  part  thickness  the  parts  are  replaced.  The  development  of  bonded  composite  repair  concept  has  provided  excellent 
opportunities  to  design  more  efficient  repairs  (References  4,  6-13)  and  in  many  cases  has  made  it  possible  to  repair 
damaged  structures  which  could  not  be  repaired  with  the  conventional  mechanical  fastening  and  were  scrapped. 
Composite  patch  repairs  also  result  in  reduced  inspection  requirements  compared  to  mechanically  fastened  repairs.  In  fact, 
in  many  cases  the  composite  patch  repairs  can  be  designed  such  that  the  cracks  in  metallic  structures  underneath  the 
repairs  will  not  grow  thereby  eliminating  inspection  requirements,  except  those  imposed  by  Integrated  Logistics  Supports 
(ILS)  plan. 

In  bonded  composite  repair  concept  a  composite  patch  is  bonded  to  the  damaged  metallic  part  instead  of  a  conventional 
mechanically  fastened  patch.  Bonded  composite  repair  has  many  advantages  over  conventional  mechanically  fastened 
repair,  namely:  1)  More  efficient  load  transfer  from  a  cracked  part  to  the  composite  patch  due  to  the  load  transfer  through 
the  entire  bonded  area  instead  of  discrete  points  as  in  the  case  of  mechanically  fastened  repairs,  2)  No  additional  stress 
concentrations  and  crack  initiation  sites  due  to  drilling  of  holes  as  in  the  case  of  mechanically  fastened  repairs,  3)  High 
durability  under  cyclic  loading,  4)  High  directional  stiffness  in  loading  direction  resulting  in  thinner  patches,  and  5) 
Curved  surfaces  and  complex  geometries  easily  repairable  by  curing  patches  in  place  or  prestaging  patches.  The  cross- 
section  of  a  typical  16-ply  graphite/epoxy  patch  bonded  to  an  aluminum  sheet  is  shown  in  Figure  17. 


The  critical  parameters  for  this  type  of  repair  are  1)  Surface  preparation,  2)  Adhesive  material  selection,  3)  Composite 
repair  material  selection,  and  4)  Bonding  operation. 

Surface  Preparation 

Proper  surface  preparation  is  one  of  the  most  important  considerations  in  bonded  structures.  The  surface  preparation 
process  consists  of  paint  removal,  anodizing  and  priming.  Liquid  chemical  paint  strippers  are  not  recommended,  as  they 
may  become  entrapped  in  cracked  areas  and  faying  surfaces  of  adjoining  structures,  thereby  causing  a  corrosion  problem. 
Aluminum  oxide  abrasive  cloth  has  been  found  to  be  suitable  for  small  repair  areas. 

Both  silane  and  phosphoric  acid  non-tank  anodize  (PANTA)  have  been  found  to  be  suitable.  The  silane  process  has  the 
advantage  of  being  non-acid  process.  However,  from  the  point  of  view  of  long  term  durability  of  repairs,  the  PANTA 
process  may  be  desirable,  as  sufficient  test  data  is  available  on  this  process. 
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Primer  is  applied  to  the  aluminum  surface  after  anodizing  with  PANT  A  to  prevent  contamination  and  improve  long-term 
durability.  BR-127  primer  has  been  found  to  be  suitable  for  FM-73  adhesive. 

Adhesive  Material  Selection 

Room  temperature  cure  adhesives  are  not  considered  suitable  due  to  service  temperature  requirements  of  180F  (82C)  in 
the  majority  of  aircraft  repair  applications.  Also,  room  temperature  cure  adhesives  are  paste  adhesives  and  generally  do 
not  result  in  uniform  bond  line  thickness  in  the  repair.  Thus,  affecting  the  load  transfer  to  composite  patch.  Hence,  high 
temperature  film  adhesives  are  preferred.  Also,  long  term  durability  of  room  temperature  adhesives  is  not  well 
characterized.  A  350F  (177C)  cure  film  adhesive  is  not  considered  desirable,  as  the  curing  at  such  a  high  temperature  is 
likely  to  cause  undesirable  high  thermal  stresses.  Also,  an  aluminum  structure  exposed  to  a  350F  (177C)  temperature  will 
undergo  degradation  in  mechanical  properties.  A  25 OF  (12 1C)  cure  adhesive  system  is  considered  suitable  for  the 
composite  patch  repair  of  aluminum  structure.  Ductile  adhesives  such  as  FM-73  are  preferred  over  brittle  adhesives  such 
as  FM-400  due  to  the  tendency  of  the  brittle  adhesives  to  disbond  around  the  damage  area,  thereby  reducing  the  load 
transfer  to  the  repair  patch. 

Composite  Repair  Material  Selection 

Both  boron/epoxy  and  graphite/epoxy  composites  are  suitable  for  the  repairs.  The  choice  between  boron  or  graphite  fibers 
should  be  based  on  availability,  handling,  processing  and  the  thickness  of  the  material  to  be  repaired.  Boron  has  higher 
modulus  than  graphite  and  would  result  in  thin  repair  patches.  Thin  patches  are  more  efficient  in  taking  load  from 
damaged  parts  as  compared  to  thick  patches.  For  repairing  relatively  thick  parts,  boron  may  be  preferred  over  graphite.  It 
is  considered  desirable  to  use  highly  orthotropic  patches,  having  high  stiffness  in  the  direction  normal  to  the  crack,  but 
with  some  fibers  in  directions  at  45  and  90  degrees  to  the  primary  direction  to  prevent  matrix  cracking  under  biaxial 
loading  and  inplane  shear  loads  which  exist  for  typical  applications.  This  patch  configuration  can  be  best  obtained  with 
unidirectional  tape.  Woven  material  has  greater  formability  and  could  also  be  used,  although  it  would  not  make  a  very 
efficient  patch. 

The  composite  patches  may  be  precured,  prestaged  or  cured  in  place.  For  locations  where  vacuum  bagging  represents  a 
problem,  a  precured  patch  may  be  prepared  in  an  autoclave  and  then  secondary  bonded  to  the  repair  area.  For  relatively 
minor  contours,  a  prestaged  patch  may  be  used.  For  curved  surfaces  the  patch  may  be  cured  in  place  during  the  bonding 
operation. 

Bonding  Operation 

Bonding  of  repair  patches  requires  a  proper  temperature  control  within  +10F  and  -5F  in  the  repair  area.  Thermal  blankets 
are  available  to  provide  temperature  in  excess  of  1000F  (538C).  A  proper  temperature  control  within  tolerances  is 
necessary  for  bondline  to  achieve  desirable  strength.  A  large  aircraft  structure  compared  to  a  small  repair  area  may  act  as  a 
heat  sink  and  jeopardize  maintaining  desired  temperature  control  for  the  required  duration.  Proper  heat  blankets  for 
surrounding  areas  may  be  required  for  such  cases. 

Crack  Growth  Life  Enhancement  with  Bonded  Composite  Repairs 

The  crack  growth  data  obtained  from  a  repaired  center-crack  panel  (7075-T6  aluminum,  0.063-inch  (1.6-mm)  thickness) 
are  shown  in  Figure  18.  It  is  seen  that  starting  with  the  same  initial  crack  length,  the  panel  without  a  repair  patch  fails  after 
about  870  missions  (0.92  lifetime)  at  a  crack  length  of  1.36-inch  (34.6-mm).  The  panel  with  the  repair  patch  did  not  fail 
even  after  2350  missions  (2.5  life  times)  at  a  crack  length  of  1.93  inches  (49  mm).  Thus,  a  considerable  extension  in  life 
was  obtained  with  the  composite  repair  patch. 
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Figure  18.  Comparison  of  Crack  Growth  in  Specimen  With  and  Without  Repair  Patch 

Comparison  of  Analytical  and  Experimental  Results 

The  crack  growth  behavior  of  the  cracked  panel  with  a  composite  patch  was  predicted  using  analytical  stress  intensity 
factors  (Ref.  14-15)  for  the  patched  structure  and  the  crack  growth  data,  obtained  on  an  unpatched  center  crack  specimen. 
Comparison  of  observed  and  predicted  fatigue  crack  growth  behavior  in  a  7075-T6  aluminum  0.063  inch  (1.6  mm) 
thickness  repaired  with  a  3  inch  (76  mm)  square  12  ply  graphite/epoxy  patch,  moisture  conditioned  to  one  percent 
moisture,  is  shown  in  Figure  19.  It  is  seen  that  the  correlation  between  predicted  and  observed  crack  growth  is  excellent. 
The  specimen  did  not  fail  even  after  two  life  times  of  spectrum  loading. 
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Figure  19.  Comparison  of  Observed  and  Predicted  Crack  Growth 

Repair  Design  for  No  Damage  Growth 

It  is  possible  to  design  composite  repair  patches  so  that  the  damage  in  the  repaired  structure  will  not  grow.  Of  course,  the 
feasibility  of  such  a  design  depends  on  the  stress  level,  the  type  of  material  to  be  repaired,  material  thickness,  the  crack 
length  to  be  repaired,  and  spectrum.  In  the  majority  of  transport  aircraft  where  design  stress  levels  are  relatively  low,  it  is 
possible  to  design  repairs  such  that  the  damage  does  not  grow.  This  is  particularly  true  for  fuselage  structures  where 
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material  is  predominantly  2024-T3  aluminum  and  gauge  thicknesses  are  small.  Crack  growth  behavior  in  2024-T3 
material  0.032-inch  (0.8-mm)  thick  specimen,  repaired  with  12-ply  Gr/Ep  patch  is  shown  in  Figure  20.  No  crack  growth 
in  two  lifetimes  of  spectrum  loading  is  seen.  Thus,  the  repairs  can  be  designed  for  no  damage  growth  and  there  by 
eliminating  inspection  requirements. 


KC-12/22-53  Lifetimes 


Figure  20.  Crack  Growth  in  2024-T3  Aluminum,  0.032  inch  (0.8  mm)  Thick  With  12-Ply  Gr/Ep  Patch 


4.3.3  IN-SERVICE  APPLICATIONS  OF  COMPOSITE  PATCH  REPAIRS 

Applications  of  composite  patch  repair  to  in-service  aircraft  are  found  in  T-38  lower  wing  skin  (References  16-19),  C-141 
weep  holes  (Reference  20)  and  F-16  fuel  access  hole  (Reference  21).  T-38  lower  wing  skin  has  developed  in-service 
cracking  problems  at  “D”  panel  attachment  holes  and  at  machined  pockets  between  39%  and  44  %  spars  and  33%  and 
39%  spars  as  shown  in  Figure  21.  Composite  patch  repair  concepts  were  developed  for  these  locations. 
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Figure  21.  Cracking  Location  in  T-38  Lower  Wing  Skin 
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Conventional  mechanically  fastened  repair  concepts  at  the  location  of  “D”  panel  are  not  possible  due  to  the  limited  space 
available  for  drilling  the  fastener  holes.  Bonding  of  an  aluminum  doubler  will  provide  only  limited  doubler  stiffness  and 
will  not  result  in  an  efficient  repair.  A  bonded  boron  repair  is  ideal  for  this  location.  An  external  boron  patch  could  not  be 
applied  as  the  door  has  to  fit  in  the  area  and  has  to  be  flush  with  the  outer  mold  line.  Hence,  an  internal  repair  patch  was 
designed  as  shown  in  Figure  22.  A  pre-cured  boron  repair  patch  was  secondary  bonded  through  the  ‘D’  panel  door. 


Figure  22.  T-38  Lower  Wing  Skin  Composite  Patch  Repair 

Lower  wing  skin  pockets  in  T-38  aircraft  between  the  39%  and  44%  spars  and  33%  and  39%  spars  at  Wing  Station  (WS) 
78  have  shown  a  propensity  for  crack  initiation  and  propagation  during  service.  The  cracks  have  initiated  at  the  pocket 
radius  in  the  inner  moldline  of  the  wing  skin.  This  cracking  has  been  occurring  primarily  under  Lead-in-Fighter  (LIF) 
spectrum  loading.  These  areas  are  ideal  for  composite  reinforcement  to  reduce  stress  levels  and  enhance  fatigue  life.  As 
there  is  no  access  for  bonding  reinforcement  on  the  inner  moldline,  a  one  sided  reinforcement  bonded  onto  the  outer 
moldline  of  the  wing  skin  was  selected.  Due  to  the  complexity  of  the  structure  in  the  area,  it  was  considered  necessary  to 
verify  the  reinforcement  design  by  structural  testing.  The  test  program  was  devised  in  two  parts.  In  the  first  part  of  the  test 
program,  testing  was  performed  on  specimens  that  simulate  the  configuration  and  load  environment  in  the  pocket  areas  of 
the  wing.  The  results  of  this  study  are  reported  in  Reference  18.  The  second  part  of  the  test  program  involved  bonding  of 
the  reinforcement  to  a  T-38  wing  (Figure  23)  subjected  to  durability  testing  at  Wright  Patterson  Air  Force  Base 
(WPAFB),  Ohio,  as  a  part  of  Air  Force  Contract  F33615-90-C-3201,  entitled  “Advanced  Technology  Redesign  of  Highly 
Loaded  Structures  (ATROHS)”.  The  wing  with  composite  reinforcement  has  undergone  3,500  hours  of  testing  under  LIF 
spectrum  loading  (Reference  17). 
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Figure  23.  Composite  Reinforcement  in  Lower  Wing  Skin  Pocket  Areas 


Vacuum-bagged  composite  reinforcement  assembly  on  T-38  test  wing  is  shown  in  Figure  24  and  bonded  reinforcement 
assembly  is  shown  in  Figure  25. 


Figure  24.  Vacuum  Bagged  Reinforcement  Assembly  on  T-38  Test  Wing 


Figure  25.  Bonded  Reinforcement  Assembly 


Composite  patch  repair  application  to  C-141  lower  wing  skin  at  weep  holes  is  shown  in  Figure  26.  Figure  27  shows 
composite  reinforcement  application  to  lower  wing  skin  splice  area. 
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SECTION  A-A 


Figure  26.  C-141  Composite  Patch  Repair  at  Weep  Holes 
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SECTION  THRU 
SKIN  PANEL  SPLICE 


Figure  27.  Composite  Patch  Repair  at  C-141  Lower  Wing  Skin  Splice 


5.  SOFTWARE  FOR  REPAIR  DESIGN  AND  ANALYSES 

A  number  of  software  programs  have  been  developed  for  designing  repairs  for  aircraft  structures.  Some  of  these  programs 

are  briefly  described  here. 

1.  RAPID-  This  program  has  been  developed  under  FAA  and  US  Air  Force  sponsorship  and  is  primarily  for 
mechanically  fastened  repairs  of  transport  aircraft.  The  program  has  capability  to  perform  analysis  under  spectrum 
loading. 

2.  RAPIDC-  This  program  has  been  developed  under  FAA  sponsorship  and  is  primarily  for  mechanically  fastened 
repairs  of  commuter  aircraft. 

3.  AFGROW-  This  is  US  Air  Force  developed  code  for  durability  and  damage  tolerance  analyses  of  aircraft  structures 
under  spectrum  loading.  This  code  has  capability  to  design  composite  patch  repairs. 

4.  CalcuRep-  This  code  has  been  developed  by  Dr.  Rob  Fredell  during  his  stay  at  US  Air  Force  Academy  in  Colorado. 
This  code  is  for  designing  bonded  repairs,  using  GLARE,  for  fuselage  type  of  structures. 

5.  FRANC2D-  This  is  a  finite  element  code  and  can  be  used  for  damage  tolerance  analysis  and  composite  patch  repair 
design  under  constant  amplitude  loading. 

6.  COMPACT3D-  This  is  a  finite  element  code  for  designing  composite  patch  repairs  under  constant  amplitude  loading. 

7.  NASGRO-  This  program  has  been  developed  by  NASA  Johnson  Space  Center  and  is  available  in  public  domain.  The 
program  is  primarily  for  damage  tolerance  analyses. 

6.0  CONCLUDING  REMARKS 

The  life  enhancement  technologies  have  provided  excellent  opportunities  to  fulfill  aging  aircraft  needs  such  as: 

1)  Reduced  life  cycle  costs 

2)  Reduced/eliminated  repairs 

3)  Reduced/eliminated  inspections 

4)  Simplified  maintenance 
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5)  Reduced  support  requirements 

6)  Fulfilled  severe  usage  requirements 

7)  Extended  airframe  life 

8)  Improved  payload 
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Summary 

The  USAF  believes  the  damage  tolerance  approach  incorporated  in  ASIP  process  in  the 
seventies  is  still  the  cornerstone  for  protecting  the  safety  of  our  aging  aircraft.  This 
process  is  primarily  deterministic  in  that  the  calculations  do  not  quantify  the  reliability  of 
the  process.  As  indicated  above,  however,  the  reliability  achieved  is  consistent  with  the 
new  aircraft  guidance  identified  in  USAF  structural  specification.  The  USAF  derives  the 
Force  Structural  Maintenance  Plan  (FSMP)  from  the  damage  tolerance  assessment  (DTA). 
The  FSMP  prescribes  for  the  maintainer  how,  when,  and  where  to  perform  inspections  to 
maintain  safety  of  flight.  There  are  cases,  however,  where  probabilistic  methods  need  to 
be  used.  It  is  the  purpose  of  this  paper  to  illustrate  the  use  of  probabilistic  methods  to 
ensure  structural  integrity. 


INPUT 

DATA: 


TASKS: 


OUTPUT:  INSPECTION  AND  MOD  REQUIREMENTS  BY  TAIL  NUMBER 


Figure  1  Damage  tolerance  approach 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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Role  of  Probabilistic  Methods 

In  the  seventies  and  eighties  there  was  considerable  activity  associated  with  the 
performance  of  DTAs  on  older  aircraft.  The  USAF  sometimes  found  the  DTA  revealed 
critical  locations  that  were  over  the  safety  limit.  In  these  cases,  the  USAF  policy  is  to 
ground  (or  severely  restrict)  these  airplanes  until  they  made  an  inspection.  In  some  of 
these  cases  the  inspection  was  so  onerous  they  grounded  the  aircraft  for  a  long  time  thus 
hindering  training  operations.  Such  a  case  occurred  on  the  F-5  dorsal  longeron.  The 
inspection  required  approximately  1350  work  hours  on  each  aircraft.  The  USAF  decided 
to  modify  the  structure  to  eliminate  this  inspection  burden.  To  determine  the  feasibility 
of  continued  use  of  the  aircraft  before  the  modification  the  USAF  performed  a  risk 
assessment  based  on  the  method  described  in  [3].  This  method  considers  the  crack  length 
distribution  and  the  stress  distribution  as  random  number  sets.  The  procedure  further 
assumes  the  crack  growth  and  the  residual  stress  functions  are  deterministic. 

Another  opportunity  for  a  risk  assessment  arose  when  the  USAF  needed  to  keep  the  T-37 
in  operational  service  after  the  cancellation  of  the  T-46  program.  The  USAF  subjected  the 
T-37  to  a  damage  tolerance  assessment.  They  found  several  areas,  in  particular,  the  wing 
to  fuselage  attachment  area,  where  the  flight  hours  on  the  aircraft  exceeded  the  safety 
limit.  The  USAF  performed  an  extensive  risk  assessment  to  allow  these  airplanes  to 
continue  in  their  training  role  until  they  could  modify  them. 


Figure  2  Damage  tolerance  experience  -  aircraft 
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In  all  of  these  cases  such  as  those  cited  above,  the  risk  assessment  did  not  include  the 
possibility  of  a  “rogue  defect”  (as  assumed  in  the  damage  tolerance  assessment).  Rather, 
they  derived  the  flaw  distribution  from  extrapolation  of  defects  found  in  typical  structural 
details.  Therefore,  in  these  cases  the  structural  engineers  made  it  clear  to  the  aircraft 
operators  they  had  not  accounted  for  the  rogue  defect. 

Another  problem  where  the  risk  assessment  is  valuable  is  in  the  case  where  the  structure 
is  in  a  state  of  generalized  cracking.  In  this  situation  the  inspection  intervals  derived  as 
indicated  above  from  the  deterministic  DTA  may  be  unconservative. 

The  USAF  had  an  opportunity  to  address  such  a  situation  for  the  wings  of  the  T-38  aircraft 
operating  in  the  Air  Training  Command.  In  the  mid-seventies,  the  USAF  performed  a 
damage  tolerance  assessment  for  the  trainer  discussed  above  in  Air  Training  Command 
usage  [3].  This  study  concluded  they  should  inspect  the  wing  center  section  at  intervals 
of  1350  flight  hours.  They  based  this  on  an  inspection  capability  for  a  corner  crack  of 
2.54  mm  and  an  inspection  at  one  half  of  the  safety  limit.  This  was  the  time  required  to 
grow  a  crack  of  2.54  mm  to  a  critical  size  crack  length  of  5.5  mm.  In  the  late  seventies,  a 
usage  change  took  place  that  made  the  loading  environment  more  severe.  The  USAF  made 
a  damage  tolerance  reassessment  for  this  new  usage.  They  found  under  the  same  ground 
rules  the  recurring  inspection  interval  should  be  430  hours. 

To  provide  an  evaluation  of  the  necessity  of  performing  inspections  at  an  increased  rate, 
they  performed  a  risk  assessment  for  the  new  usage,  but  old  inspection  schedule.  The 
assessment  based  on  an  inspection  interval  of  1350  flight  hours  showed  the  risk  was 
unacceptable.  When  they  reduced  the  inspection  interval  to  300  hours,  they  found  an 
acceptably  low  probability  of  failure.  Therefore,  they  concluded  they  had  to  improve  the 
inspection  reliability  or  decrease  the  inspection  interval  from  that  derived  from  the 
deterministic  DTA. 

There  are  other  cases  where  probabilistic  methods  can  complement  the  DTA.  These  cases 
typically  involve  difficulty  with  the  performance  of  the  DTA.  One  can  find  examples  of 
this  in  the  assessment  of  mechanical  subsystems.  Many  of  these  parts  are  not  tolerant  to 
the  size  defects  assumed  for  airframe  structure.  Also,  the  loading  environments  are 
difficult  to  simulate  analytically.  One  finds  another  example  in  the  high  strength  steel 
structures  such  as  gears.  In  these  cases  some  of  the  classical  reliability  approaches  may 
be  useful.  As  indicated  in  [4],  W.  Weibull  from  Sweden  performed  a  number  of  fatigue 
experiments  in  the  middle  of  the  fifties.  He  found  the  results  of  these  experiments 
conformed  to  a  probability  distribution,  known  today  as  the  Weibull  distribution. 

Figure  (3)  shows  Weibull  distributions  that  cover  the  range  normally  found  in  the  fatigue 
of  aircraft  structural  components.  One  notes  the  coefficients  of  variation  (the  standard 
deviation  divided  by  the  mean)  of  these  distributions  are  typically  much  higher  than  found 
for  static  strength.  Figure  (4)  shows  the  reliability  with  95  percent  confidence  as 
dependent  on  the  number  of  test  lifetimes.  The  results  shown  are  for  several  Weibull 
shape  numbers.  This  calculation  assumed  there  were  no  more  than  two  like  features  in  the 
aircraft.  One  sees  a  high  reliability  structure  is  difficult  to  achieve  when  the  Weibull 
shape  number  is  of  the  order  of  two  or  three. 
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Figure  3  Weibull  probability  density  functions 


Figure  4  (1  -  reliability)  with  95%  confidence 

One  of  the  problems  associated  with  the  early  applications  of  the  safe  life  approach  was 
that  it  did  not  account  for  the  fatigue  characteristics  of  the  individual  materials  in  the 
structure.  Therefore,  the  USAF  used  the  same  scatter  factor  independent  of  the  structural 
material  or  the  stress  spectra.  The  structural  analyst  knows  today  there  are  considerable 
differences  between  the  Weibull  scale  numbers  depending  on  material  and  spectra. 

The  currently  acceptable  structural  reliability  as  reflected  in  [2]  is  for  a  single  flight  of  an 
aircraft  from  a  given  population  the  probably  of  failure  should  be  no  greater  than  10"7. 
This  means  the  desired  reliability  of  the  structure  should  be  of  the  order  of  0.999. 

Typically,  one  determines  the  Weibull  shape  number  through  testing  of  multiple  similar 
parts.  An  analytical  example  serves  to  illustrate  how  accurately  one  could  determine  the 
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Weibull  shape  number.  For  this  purpose,  one  may  sample  a  population  with  a  known 
Weibull  shape  number.  In  the  first  case  under  consideration  the  Weibull  shape  number  is 
two  and  the  analyst  selected  ten  random  samples  to  simulate  the  testing  of  ten  specimens. 
A  simple  transformation  permits  plotting  these  ten  sample  points  on  a  graph  where  the 
Weibull  distribution  is  a  straight  line.  Further,  on  this  graph  the  negative  of  the  slope  of 
that  line  is  the  Weibull  shape  number.  Figure  (5)  shows  the  comparison  of  the  original 
distribution  and  the  sampled  distribution.  Figure  (6)  shows  these  distributions  in  the 
usual  manner.  One  may  use  the  same  process  to  sample  a  distribution  where  the  Weibull 
shape  number  is  four.  Figure  (7)  and  Figure  (8)  show  these  results.  One  sees  for  small 
samples  such  as  used  here,  the  potential  for  error  in  the  assessment  of  the  Weibull  shape 
number  may  be  significant.  In  these  cases  the  judgment  on  the  reliability  of  the  structural 
component  could  be  in  considerable  error.  However,  if  one  adequately  interrogates  the 
population  the  results  are  useful.  Because  of  the  difficulties  cited,  the  USAF  recommends 
the  application  be  limited  to  structures  that  are  fail-safe. 
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Figure  6  Weibull  sample  comparison  for  a  =  2 
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Figure  7  Weibull  approximation  for  a  =  4  and  10  samples 


Widespread  Fatigue  Damage 

A  phenomenon  occurring  more  frequently  than  generalized  cracking  is  widespread  fatigue 
damage  (WFD).  WFD  is  a  major  concern  in  aircraft  that  rely  on  fail-safety  for  structural 
integrity.  The  USAF  has  learned  WFD  can  degrade  the  fail-safe  capability  of  a  structure 
with  cracking  that  is  of  the  order  of  one  to  two  millimeters  [5]. 

A  deterministic  definition  of  WFD  is  the  following:  The  onset  of  WFD  in  a  structure  is 
characterized  by  the  simultaneous  presence  of  cracks  at  multiple  structural  details  which 
are  of  sufficient  size  and  density  whereby  the  structure  will  no  longer  meet  its  damage 
tolerance  requirement  (that  is,  maintaining  required  residual  strength  after  partial 
structural  failure). 
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In  many  cases  this  definition  is  difficult  to  apply  because  of  the  complex  cracking 
scenarios.  Further,  this  definition  may  lead  to  an  excessively  conservative  determination 
of  the  time  of  WFD  onset.  An  alternate  definition  that  removes  these  problems  is  the 
following:  The  onset  of  widespread  fatigue  cracking  is  that  point  in  the  operational  life  of 
an  aircraft  when  the  damage  tolerance  or  fail-safe  capability  of  a  structure  has  been 
degraded  such  that  after  partial  structural  failure  the  probability  of  failure  of  the  structure 
falls  below  the  thresholds  specified  by  the  procuring  (or  certification)  agency. 

For  the  USAF,  the  threshold  single  flight  probability  of  failure  for  the  intact  structure  is 
10'7.  The  USAF  has  determined  the  threshold  for  the  acceptable  conditional  single  flight 
probability  of  failure  through  their  perception  of  the  discrete  source  damage  threat.  In  the 
case  of  the  C-5A  they  assumed  the  probability  of  discrete  source  damage  was  10"3  [6].  For 
the  case  of  the  707  they  assumed  it  was  10'4  [7]. 

One  of  the  primary  inputs  to  the  risk  assessment  approach  to  determine  the  onset  of  the 
time  to  WFD  is  the  distribution  of  cracks  in  the  structure.  The  USAF  has  determined  this 
distribution  through  teardown  inspections  of  full-scale  fatigue  test  articles  or  operational 
aircraft.  They  believe  this  is  the  best  method  currently  available  to  obtain  the  data 
required  to  derive  the  probability  distribution  function  for  equivalent  initial  cracks  in  the 
critical  areas  of  the  structure.  The  word  "critical"  here  refers  to  an  area  that  could 
significantly  contribute  to  the  probability  of  failure. 

The  probabilistic  approach  also  requires  that  the  analyst  determine  the  stress  density 
function  for  each  critical.  The  USAF  derives  this  function  from  the  available  usage 
information  generated  by  their  individual  aircraft  tracking  programs.  The  desired  stress 
density  function  is  the  one  for  a  single  flight  of  an  aircraft  selected  at  random.  The 
structural  analyst  can  easily  derive  this  function  from  the  stress  exceedance  function 
developed  as  a  part  of  the  deterministic  damage  tolerance  analysis.  One  can  then  compute 
the  joint  probability  distribution  of  cracks  and  stress  and  integrate  this  function  over  the 
point  set  where  the  crack  size  has  reached  critical  length.  The  result  of  this  calculation  is 
the  single  flight  probability  of  failure.  The  time  at  which  the  probability  of  failure  is 
unacceptable  is  the  onset  of  WFD. 

Therefore,  the  USAF  considers  the  cracks  in  the  structure  and  the  stresses  at  the  critical 
locations  as  random  number  sets.  The  crack  growth  function  and  the  residual  strength 
function  are  also  treated  as  random  functions  because  of  the  intrinsic  variability  of  the 
material  properties.  Unfortunately,  for  a  given  population  of  aircraft  these  random 
number  sets  are  not  easily  quantifiable.  Fortunately,  the  variability  of  these  functions 
does  not  appear  to  have  a  major  impact  on  the  risk  of  failure.  Therefore,  the  analyst  uses 
his  best  estimate  of  the  mean  of  these  functions  in  the  risk  assessment. 

The  damage  scenarios  in  an  airplane  that  could  constitute  WFD  differ  depending  on 
location  in  the  aircraft.  However,  typically,  they  fall  into  two  categories.  The  first  of 
these  is  multiple-site  damage  -  characterized  by  cracks  in  multiple  details  in  the  same 
structural  element.  The  second  is  multiple-element  damage  where  there  are  cracks  in 
multiple  structural  elements. 

Previous  efforts  have  shown  the  analyst  can  readily  apply  this  type  of  analysis  to  the 
structures  where  the  concern  is  multiple-element  damage.  This  was  the  case,  for  example, 
for  the  KC-135  and  the  C-5A.  The  application  of  the  risk  assessment  technology  to  the 
case  of  multiple-site  damage  is  very  much  the  same  as  it  is  for  the  case  of  multiple- 
element  damage.  In  the  case  of  multiple-site  damage  there  will  typically  be  a  "boundary" 
that  will  determine  if  the  cracking  has  the  potential  to  become  catastrophic.  For  example 
in  the  case  of  the  fuselage  lap  splice,  the  boundary  would  be  the  crack  stopper  built  into 
the  structure  at  the  frame  or  between  the  frames  and  its  surrounding  structure.  This  crack 
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arrest  feature  protects  the  integrity  of  the  structure.  The  condition  of  the  crack  stopper 
and  its  surrounding  structure  (that  is,  the  boundary)  will  determine  if  the  damage  could 
propagate  to  catastrophic  failure.  Therefore,  the  interest  is  primarily  in  the  degradation  of 
the  boundary  with  time  and  not  the  growth  of  the  holes  in  the  lap  splice  to  link-up.  When 
one  thinks  of  the  problem  in  this  manner,  then  it  may  be  solvable  in  a  manner  similar  to 
that  used  for  the  multiple-element  damage  problem.  Lockheed  [8]  demonstrated  an 
example  this  of  this  in  their  risk  assessment  on  of  the  inner  to  outer  wing  joint  of  the 
C-141  aircraft. 

There  must  be  emphasis  placed  on  the  detection,  through  nondestructive  evaluation,  of 
cracks  that  could  be  significant  for  determination  of  the  onset  of  WFD.  As  indicated 
above,  there  is  a  need  to  make  an  estimate  of  this  onset  based  on  probabilistic  assessment 
of  cracking  data  derived  from  the  teardown  inspection  of  fatigue  test  articles  or 
operational  aircraft.  One  must  recognize,  however,  that  this  is  only  an  estimate.  It  is  not 
realistic  to  expect  the  analyst  could  determine  this  time  with  great  accuracy  even  with  the 
most  sophisticated  fracture  mechanics  programs.  The  actual  time  may  be  either  somewhat 
earlier  or  later  than  this  estimate.  It  is  important,  therefore  to  be  able  to  validate  this 
prediction  with  nondestructive  evaluation.  This  is  difficult  because  the  size  of  defect  the 
inspector  must  find  is  quite  small.  The  experimental  evidence  to  date  indicates  cracks  of 
the  order  of  two  millimeters  can  significantly  lower  the  fail-safety  capability  of  certain 
structural  configurations. 

Weapon  System  Risk  Assessments 

C-5A  Risk  Assessment 

One  of  the  early  technical  challenges  for  this  program  was  how  long  to  leave  this  aircraft 
in  service  with  the  original  wing  design.  By  the  mid-seventies,  the  USAF  established  the 
damage  tolerance  initial  flaw  size  for  slow  crack  growth  structure  for  fastener  holes  as 
1.27  millimeters  [9].  On  the  basis  of  this  flaw  size  the  safety  limit  was  7,000  flight  hours 
of  the  so-called  14  mission  flight  profiles.  In  this  case  the  time  for  the  1.27  millimeter 
flaw  to  grow  to  the  critical  crack  length  was  the  safety  limit.  Since  the  wing  was  not 
inspectable,  this  was  also  the  life  limit  for  the  wing.  The  USAF  made  a  final  validation  of 
the  life  of  the  wing  through  a  teardown  inspection.  They  took  this  wing  from  service 
when  it  had  accumulated  7,000  hours  equivalent  to  the  14  mission  flight  profiles.  In  the 
teardown  inspection,  Lockheed  examined  44,641  fastener  holes  in  detail  for  cracking. 
They  did  this  work  in  the  late  seventies.  From  the  population  of  cracks  found  in  this 
teardown  inspection  the  USAF  performed  an  assessment  to  determine  the  probability  of 
catastrophic  failure  and  the  time  the  wing  lost  its  fail-safety.  The  USAF  found  that  at 

7,000  hours  the  wing  had  initially  exceeded  the  acceptable  10"^  single  flight  failure 
probability.  Further,  they  found  the  wing  had  lost  fail-safety  based  on  a  conditional 

single  flight  failure  probability  of  10"^.  This  effort  confirmed  the  USAF  should  take  this 
structure  out  of  service  no  later  than  7,000  flight  hours  of  equivalent  14  mission  profile 
usage.  They  decided  to  allow  the  aircraft  to  fly  to  7,000  hours  with  fail-safety 
compromised  at  4,500  hours.  The  replacement  wing  box  will  easily  meet  the  original  life 
requirement  of  30,000  flight  hours. 

C-141  Risk  Assessment 

The  USAF  found  a  major  WFD  problem  in  the  wing  at  Wing  Station  405  joint  [8].  The 
USAF  observed  first  cracking  on  an  operational  aircraft  in  late  1984.  In  early  1989,  they 
found  an  aircraft  with  a  severed  beam  (or  spar)  cap.  The  USAF  recommended  that 
Lockheed  perform  a  risk  assessment  based  on  operational  aircraft  cracking  data  to  assess 
the  likelihood  of  catastrophic  failure  of  the  aircraft.  The  risk  assessment,  as  expected, 
indicated  the  joint  was  extremely  critical..  The  USAF  had  found  numerous  cracks  in  the 
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area  of  the  rear  beam  on  many  airplanes.  In  addition,  they  found  a  number  of  spar  cap 
failures.  Also,  there  have  been  multiple  cracks  discovered  in  the  area  of  the  forward  beam 
on  many  airplanes.  The  risk  assessment  performed  by  Lockheed  showed  although 
inspections  were  somewhat  effective  in  reducing  the  risk,  the  best  alternative  was  to 
perform  a  modification  on  the  joint.  The  USAF  initiated  aircraft  restrictions,  an 
inspection  program,  and  an  accelerated  modification  program  to  alleviate  this  problem. 
The  action  to  remove  WFD  by  a  modification  is  similar  to  the  earlier  actions  taken  on  the 
KC-135  and  C-5A  [6].  In  the  case  of  the  KC-135  and  C-5A  the  emphasis  was  on  the 
elimination  of  the  WFD  problem  rather  than  trying  to  manage  it  through  an  inspection 
program. 

The  USAF  found  another  major  WFD  problem  in  wing  lower  surface  fuel  transfer  holes 
(weep  holes).  There  are  more  than  1500  such  weep  holes  in  each  wing  (both  sides).  The 
cracking  experiences  with  the  weep  holes  dates  back  to  the  original  fatigue  test.  After 
90,000  hours  of  block  testing  on  the  test  article,  Lockheed  found  cracking  in  many  of  the 
weep  holes.  Lockheed  cold  expanded  these  holes  before  they  resumed  testing  with  flight- 
by-flight  loading.  The  additional  28,468  hours  of  testing  showed  the  cold  expansion  was 
effective  in  controlling  the  weep  hole  cracking.  Lockheed  made  a  recommendation  to 
WR-ALC  in  September  of  1983  to  perform  the  cold  expansion  on  C-141  aircraft  with 
30,000  hours.  In  January  1993  the  USAF  Scientific  Advisory  Board  (SAB)  reviewed  the 
potential  for  a  service  life  extension  of  the  C-141.  They  found  the  USAF  had  cold 
expanded  weep  holes  on  only  six  operational  aircraft.  They  also  found  the  weep  hole 
inspection  results  were  difficult  to  understand.  One  aircraft  the  USAF  had  found  ninety- 
nine  weep  hole  cracks,  the  longest  of  which  was  approximately  12  millimeters.  They 
found  other  aircraft  relatively  free  of  cracks.  However,  there  had  been  several  cases 
where  the  weep  hole  cracks  had  progressed  through  the  skin  and  had  caused  in-flight 
evident  fuel  loss.  To  understand  this  apparent  anomaly,  the  SAB  recommended  a 
teardown  inspection  of  an  aircraft.  The  USAF  tore  down  aircraft  number  66-0186,  in 
which  the  USAF  had  found  ninety-nine  cracks.  It  had  23,824  flight  hours  of  relatively 
high  damage  usage,  which  converted  to  44,539  damage  hours  (that  is,  hours  of  equivalent 
SLA-IIB  spectrum  usage)  on  the  lower  inner  wing  skin.  The  teardown  inspection  on 
aircraft  number  66-0186  has  revealed  numerous  holes  with  poor  quality  and  a  total  of  255 
cracked  holes.  Subsequently,  WR-ALC  performed  an  additional  inspection  and  a  limited 
teardown  inspection  on  66-9410,  which  had  45,202  equivalent  damage  hours  on  the  inner 
wing  lower  surface.  The  results  of  the  additional  inspection  have  shown  there  was 
extensive  cracking  in  the  weep  holes  of  this  aircraft.  Consequently,  the  USAF  concluded 
the  cracking  observed  in  these  two  is  representative  of  the  aircraft  with  that  number  of 
equivalent  damage  hours.  They  concluded  the  early  inspection  results  were  unreliable. 
They  changed  the  inspection  procedure  and  validated  it  on  a  teardown  inspection  aircraft. 
The  size  of  the  cracks  found  led  them  to  the  conclusion  there  was  severely  degraded  fail¬ 
safe  capability  in  the  wing.  Also  as  indicated  by  the  distribution  of  cracks,  the  cracks 
tend  to  line  up  which  contributes  to  the  loss  of  fail-safety.  These  airplanes  were  in  a  state 
of  WFD.  Therefore,  the  USAF  placed  the  airplanes  on  restrictions  and  an  inspection 
program.  They  developed  an  inspection  program  designed  to  preclude  the  cracks  from 
reaching  critical  length  and  failing  a  wing  panel.  In  addition,  they  developed  a 
modification  program  to  eliminate  this  problem.  The  modification  program  consisted  of 
three  parts.  They  found  they  could  remove,  or  nearly  remove,  most  of  the  cracks  by 
reaming  them.  They  elected  to  cold  expand  these  holes.  In  many  airplanes  there  were 
only  approximately  ten  locations  where  cold  expansion  was  not  an  alternative  because  the 
cracks  were  too  large.  Fortunately,  at  this  time,  the  Wright  Laboratory  was  completing  a 
major  program  that  would  give  the  USAF  the  technology  for  patching  metallic  structures 
with  composites.  This  appeared  to  be  a  more  attractive  alternative  than  the  conventional 
metallic  patches  that  required  additional  fastener  holes  in  the  lower  surface  of  the  wing. 
Therefore,  the  modification  for  those  airplanes  with  a  small  number  of  large  cracks  would 
be  composite  patching.  For  aircraft  that  had  a  large  number  of  large  cracks  the  only 
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alternative  was  replacement  of  wing  panels.  Lockheed  performed  a  risk  assessment  to 
better  understand  the  severity  of  the  weep  hole  cracking  problem.  After  reviewing  the 
results  of  this  assessment,  the  USAF  made  recommendations  for  subsequent  actions.  They 
decided  not  to  fly  any  aircraft  that  had  in  excess  of  40,000  damage  hours  on  the  lower 
inner  wing  surface  until  they  performed  a  weep  hole  inspection.  They  would  inspect  the 
remainder  of  the  aircraft  and  modify  them  based  on  a  one  year  schedule.  They  found  weep 
hole  cracking  in  practically  all  of  the  aircraft.  The  nondestructive  inspection  program 
revealed  a  total  of  11,000  cracks  in  the  weep  holes  in  the  entire  fleet.  The  USAF  found  no 
cracks  in  the  weep  holes  that  had  been  cold  expanded.  WR-ALC,  with  the  support  of  the 
Wright  Laboratory  [9],  accomplished  the  tremendous  task  of  restoring  these  airplanes  to 
flight  status.  They  repaired  the  wings  carefully  with  composite  patching  to  ensure  they 
had  not  degraded  structural  integrity  of  the  aircraft.  They  returned  these  airplanes  to 
unrestricted  usage  when  they  placed  them  back  into  service. 

The  USAF  believed  that  WFD  of  the  inner  wing  spanwise  splices  was  a  significant  factor 
in  the  C-141  continued  airworthiness.  They  had  learned  this  from  the  loss  of  fail-safety  in 
the  C-5A  wing.  In  1990  the  USAF  [11]  estimated  they  could  expect  WFD  in  the  spanwise 
splices  in  inner  wing  lower  skin  at  about  45,000  SLA-II  equivalent  flight  hours.  They 
based  this  estimate  the  teardown  inspection  of  the  C-141  fatigue  test  article  (Specimen 
A)..  The  size  of  cracks  that  could  cause  loss  of  fail-safety  in  the  C-141  inner  lower  wing 
is  in  the  order  of  1.5  millimeters.  Lockheed  performed  an  additional  assessment  of  the 
risk  based  on  teardown  inspections  of  wing  panels  taken  from  operational  aircraft.  They 
found  significant  degradation  of  fail-safety  at  37,000  hours.  The  USAF  made  the  decision 
to  manage  the  safety  of  those  airplanes  above  37,000  hours  by  slow  crack  growth.  This 
decision  resulted  in  a  very  difficult  inspection  program  [7]. 

707  Risk  Assessment 

The  USAF  elected  in  the  eighties  to  use  the  707  aircraft  for  Joint  Stars  (Joint  Surveillance 
Target  Attack  Radar  System).  When  Northrop  Grumman,  the  contractor  for  Joint  Stars, 
selected  the  aircraft,  the  configuration  was  the  primary  concern  -  not  the  age.  Many  of 
the  airplanes  selected  were  close  to  (or  above)  the  original  life  goals  of  sixty  thousand 
flight  hours  and  twenty  thousand  flights  established  by  Boeing  for  the  707. 

The  largest  concern  about  the  structure  of  this  aircraft  was  the  potential  for  the 
degradation  of  fail-safety  because  of  WFD  in  the  wing.  Boeing  performed  a  teardown 
inspection  on  a  relatively  high  time  aircraft  in  the  mid  seventies.  The  inspection 
performed  by  Boeing,  completed  in  1976,  revealed  numerous  cracks  in  the  aircraft.  The 
cracks  that  caused  the  most  concern  were  in  the  lower  wing  splicing  stringers  and  the 
large  stringers  around  the  lower  wing  inspection  holes  adjacent  to  the  splicing  stringers. 
Boeing  published  several  Service  Bulletins  as  a  result  of  these  wing  crack  findings.  These 
Service  Bulletins  called  for  either  a  high  frequency  eddy  current  inspection  inside  of  the 
wing  or  an  external  low  frequency  eddy  current  inspection.  These  inspections  have 
revealed  major  damage  including  a  severed  stringer  and  skin  cracks  in  excess  of  44 
millimeters.  The  Boeing  database,  however,  was  not  definitive  enough  to  be  usable  in  an 
assessment  of  the  risk  of  failure.  Consequently,  the  USAF  contracted  with  Boeing  to 
examine  higher  time  aircraft  parts  taken  from  retired  aircraft  at  Davis  Monthan  Air  Force 
Base  to  quantify  the  risk  associated  with  WFD  [7]. 

Boeing  performed  a  teardown  inspection  on  a  707-300  wing  from  an  aircraft  at  Davis 
Monthan  Air  Force  Base.  This  aircraft,  representative  of  the  Joint  Stars  aircraft,  had 
experienced  57,382  flight  hours  and  22,533  flights.  They  performed  the  teardown 
inspection  on  the  wing  lower  surface  and  the  wing  stringers.  Stringers  and  skins  where 
Boeing  used  steel  fasteners  contained  most  of  the  cracks  found.  This  was  typically  in  the 
area  of  the  wing  skin  splices  and  the  large  adjacent  stringers.  The  beneficial  effects  of 
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the  aluminum  rivets  attaching  the  other  stringers  to  the  wing  skins  apparently  reduced  the 
amount  of  cracking  there.  There  was,  however,  some  cracking  found  in  these  locations. 

Boeing  found  that  cracking  in  the  aircraft  in  the  area  of  the  steel  fasteners  was  quite 
extensive.  They  found  a  total  1915  cracks  found  in  five  sections  removed  from  the 
aircraft.  Most  of  the  cracks  found  were  small.  However,  they  found  a  significant 
population  cracked  to  the  point  of  considerable  concern.  They  found  that  increasing  the 
size  of  the  holes  in  the  splicing  stringer  and  the  large  adjacent  stringer  would  not  remove 
all  of  the  cracks.  About  twenty  percent  of  these  holes  would  still  have  stringer  cracks. 
Further,  they  found  significant  cracking  outboard  of  the  Wing  Station  360  production 
joint.  Therefore,  the  problem  involved  most  of  the  wing.  Typically,  the  large  adjacent 
stringers  had  more  large  cracks  than  the  splicing  stringers.  The  largest  crack  found  in  a 
stringer  was  approximately  38  millimeters  in  length.  It  was  near  the  point  of  rapid 
fracture.  There  were,  however,  many  cracks  found  that  would  have  gone  to  failure  in  the 
planned  life  span  of  the  Joint  Stars  aircraft.  There  was  a  concern  about  cracking  that 
would  degrade  the  capability  of  the  structure  to  sustain  discrete  source  damage.  There 
was  also  a  concern  about  the  fatigue  failure  of  the  stringers  and  subsequent  catastrophic 
loss  of  the  aircraft  after  a  skin  failure. 

Boeing  calculated  the  stress  intensity  of  each  of  the  cracks  found.  They  then  determined 
for  each  of  them  the  size  of  the  corner  crack  with  the  same  stress  intensity.  From  these 
cracks,  the  USAF  derived  the  crack  distribution  function.  They  used  a  population  taken 
from  the  largest  of  them  to  approximate  the  crack  distribution  with  a  two  parameter 
Weibull  distribution  function.  It  is  typical  that  a  single  Weibull  distribution  function  will 
not  approximate  the  longer  cracks  as  well  as  the  shorter  cracks.  This  is  not  a  problem 
since  only  the  longer  cracks  will  have  a  significant  effect  on  the  risk  of  failure. 

The  USAF  needed  two  stress  distribution  functions  for  the  assessment.  The  first  is  the 
stress  distribution  function  for  the  intact  structure.  Boeing  derived  this  in  the  usual 
manner  from  the  intended  usage  of  the  aircraft,  the  external  load  analysis,  and  the  stress 
analysis  of  the  wing.  Second,  for  the  cases  where  discrete  source  damage  was  present 
they  determined  the  local  stress  increase  from  the  damage.  In  many  cases  the  local  stress 
increased  to  the  point  where  there  was  significant  plastic  deformation  of  the  structure. 
When  this  occurs  it  is  essential  the  plastic  deformation  be  included  in  the  analysis.  A 
linear  analysis  in  these  cases  would  likely  lead  to  serious  errors  in  the  determination  of 
risk. 

For  the  cases  of  discrete  source  damage  the  maximum  single  flight  failure  probability 
allowed  was  10"3  and  for  the  intact  structure  case  the  maximum  single  flight  failure 
probability  allowed  was  10'7.  For  the  stated  criteria  for  discrete  source  damage,  the  USAF 
found  significant  degradation  of  fail-safety  beyond  50,000  flight  hours  of  commercial 
usage.  Therefore,  for  some  aircraft,  there  will  be  unacceptable  fail-safety  degradation 
before  the  end  of  the  planned  20,000  hours  of  Joint  Stars  usage.  This  will  occur  for  Joint 
Stars  aircraft  with  more  than  36,000  commercial  usage  hours.  Further,  for  the  case  of  no 
discrete  source  damage,  there  will  be  safety  degradation  beyond  58,000  hours  of 
commercial  usage.  Therefore,  aircraft  with  initially  more  than  44,000  hours  of 
commercial  usage  will  have  a  high  probability  of  failure  before  operationally  flying 
20,000  hours. 

There  are  two  possible  approaches  for  solution  of  this  problem.  The  first  is  to  remove  the 
steel  fasteners  in  the  area  of  concern  in  the  lower  wing  surface  and  perform  an  eddy 
current  inspection.  If  the  inspector  finds  no  indication  of  a  crack  or  if  increasing  the  size 
of  the  hole  would  remove  the  indication,  then  this  hole  would  be  cold  expanded.  For 
cracks  that  are  too  large  for  this  remedy,  the  USAF  could  utilize  a  repair  such  as 
composite  patching.  This  approach  appears  to  be  viable  for  aircraft  with  less  than  45,000 
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commercial  usage  flight  hours.  It  also  may  be  viable  for  aircraft  in  the  45,000  to  55,000 
flight  hour  range.  A  second  alternative  would  be  to  replace  the  wing  panels  and  stringers 
in  the  area  of  concern.  This  may  be  the  only  alternative  for  aircraft  with  more  than 
55,000  commercial  usage  flight  hours. 

Widespread  Fatigue  Damage  Example  Risk  Assessment 

The  following  example  illustrates  some  of  the  essential  features  of  the  risk  analysis 
process.  The  example  determines  the  risk  of  catastrophic  failure  for  both  the  intact  and 
partially  failed  structure  of  a  hypothetical  aircraft  designed  for  a  30,000  hour  life.  The 
aircraft  is  to  fly  only  one  mission  that  is  two  hours  in  length.  The  aircraft  has  one  critical 
area  with  500  fastener  holes.  The  initial  crack  distribution  is  the  crack  distribution 
function  derived  from  a  teardown  inspection.  Figure  (9)  shows  the  corresponding  crack 
density  function.  Figure  (10)  shows  the  corresponding  crack  distribution  function.  For 
the  intact  structure,  Figure  (11)  shows  the  stress  exceedance  function  for  each  of  these 
holes.  Figure  (12)  shows  the  corresponding  stress  probability  distribution  function, 
derived  from  the  exceedance  function.  Figure  (13)  shows  the  stress  density  function.  The 
threat  of  discrete  source  damage  is  10'3.  For  the  partially  failed  structure,  only  ten  of  the 
500  fastener  holes  have  their  stress  increased  to  1.5  times  the  stress  for  the  intact 
structure.  Figure  (14)  shows  the  residual  stress  function.  The  crack  growth  function 
modifies  the  initial  crack  distribution  function  so  the  crack  probability  distribution  has 
the  correct  time  dependence.  Figure  (15)  shows  the  crack  growth  function.  Figure  (16) 
shows  the  final  function  needed  for  the  calculation  of  risk.  This  is  the  inspection 
probability  of  detection  function. 


Figure  9  Crack  density  function  from  the  A-7D 


cxceeaances  pe 


Figure  12  Stress  probability  distribution  function 


Figure  13  Stress  probability  density  function 
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Crack  length  in  millimeters 
Figure  16  Probability  of  detection  function 

Figure  (17)  shows  the  single  flight  probability  of  failure  for  the  intact  structure  without 
inspections.  From  this  figure,  one  sees  the  risk  exceeds  the  10'7  threshold  of  acceptability 
at  about  22,000  flight  hours.  From  Figures  (14),  (15),  and  (16)  the  analyst  can  determine 
the  damage  tolerance  inspections.  The  first  inspection  is  at  7600  flight  hours  and  the 
inspection  interval  following  the  first  inspection  is  5000  hours.  Figure  (18)  shows  the 
single  flight  probability  of  failure  for  the  intact  structure  with  inspections.  One  sees 
these  inspections  are  quite  effective  in  reducing  the  risk  of  failure  and  containing  the  risk 
within  acceptable  limits  to  30,000  flight  hours.  It  is  clear  from  this  figure  that  on  the 
basis  of  the  inspection  capability  assumed  and  the  inspection  interval  derived  from  the 
damage  tolerance  methodology  the  risk  is  increasing  significantly.  Therefore,  one  must 
make  a  reduction  in  the  inspection  period  if  one  intends  to  fly  the  aircraft  significantly 
beyond  its  original  life  of  30,000  flight  hours. 


Single  flight  failure  probability 


Figure  17  Intact  structure  with  no  inspections 
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Single  flight  failure  probability 


Figure  18  Intact  structure  with  inspections 


Figure  (19)  shows  the  single  flight  failure  probability  for  the  partially  failed  structure 
without  the  effect  of  inspections.  This  is  the  conditional  probability  for  the  structure 
damaged  from  an  external  source.  One  sees  the  risk  crosses  the  threshold  of  acceptability 
for  this  case  (that  is,  10'4)  at  approximately  16,000  flight  hours.  The  aircraft  has 
degraded  fail-safe  capability  long  before  the  time  the  intact  structure  has  reached  the 
unacceptable  risk  threshold.  Figure  (20)  shows  the  influence  of  inspections  on  the 
probability  of  failure.  One  sees  the  inspections  are  essentially  ineffective  in  reducing  the 
risk  for  this  case.  This  example  clearly  illustrates  the  damage  tolerance  derived 
inspection  program  may  not  adequately  protect  the  fail-safety  of  an  aircraft  in  the 
presence  of  widespread  fatigue  cracking. 

Single  flight  failure  probability 


Figure  19  Damaged  structure  with  no  inspections 


5-18 


Single  flight  failure  probability 


Figure  20  Damaged  structure  with  inspections 

Conclusions 

As  indicated  above,  the  cornerstone  for  protecting  the  safety  of  USAF  aircraft  is  damage 
tolerance.  There  are  some  cases,  however,  where  probabilistic  methods  find  an  important 
use.  One  approach  that  appears  to  be  attractive  especially  for  mechanical  subsystems  is 
the  use  of  reliability  analyses  based  on  testing.  In  some  cases  these  methods  can  provide 
satisfactory  solutions  where  a  damage  tolerance  assessment  may  be  impractical.  The 
USAF  believes  the  process  may  apply  to  mechanical  subsystems  since  they  are  typically 
fail-safe  by  design. 

A  major  problem  in  aging  aircraft  is  WFD.  It  is  essential  to  establish  an  estimate  of  the 
time  of  onset  of  this  problem.  The  USAF  does  this  through  the  analysis  of  data  derived 
from  teardown  inspections  of  fatigue  test  articles  and  of  operational  aircraft.  They  will 
need  to  corroborate  these  estimates  through  the  use  of  detailed  inspections  of  suspect 
structural  elements.  In  some  cases  the  nondestructive  inspection  capability  does  not  exist 
to  economically  find  WFD  size  cracks.  The  USAF  must  continue  their  effort  to  attain  this 
capability.  Once  the  aircraft  operator  determines  the  aircraft  has  reached  the  time  of 
onset  of  WFD,  he  needs  to  make  modifications  of  the  structure  to  remove  this  problem. 
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1.  SUMMARY 

Degradation  of  the  mechanical  properties  of  a  material  interacting  with  the  environment  is  probably  the  best 
and  widest  definition  for  corrosion.  In  particular,  as  mechanical  properties  are  the  driving  forces  in  the  design 
of  military  aircraft,  corrosion  in  airframes  must  be  considered  as  a  major  problem  because  it  directly  affects 
safety,  economic  and  logistic  issues. 

Considering  the  variety  of  materials,  environments  and  mechanical  stresses  involved  in  the  aeronautical  field, 
it  represents  one  of  the  areas  where  the  largest  spectrum  of  corrosion  types  is  observed. 

Many  classification  can  be  used  to  categorize  aircraft  corrosion  phenomena:  wet  or  dry  corrosion  depending 
on  the  environment,  time  dependent  or  time  independent  phenomena,  mechanically  or  not  mechanically 
assisted  corrosion  failures,  etc.;  all  of  them  are  useful  to  understand  the  main  cause  of  the  observed  corrosion 
case  and  consequently  to  apply  the  most  adequate  corrective  actions. 

The  purpose  of  this  lecture  is  to  provide  an  overview  on  the  most  common  forms  of  corrosion  experienced  in 
the  past,  in  order  to  present  a  wide  range  of  severity  arising  from  cosmetic  to  catastrophic  failures. 

Particular  attention  will  be  given  to  the  corrosion  aspects  related  with  aging  aircraft  issues. 

2.  INTRODUCTION 

Although  aircraft  corrosion  is  an  old  matter  and  many  advances  have  already  been  done  in  corrosion 
prevention  and  materials  selection  science,  nevertheless  it  seems  far  to  be  solved. 

For  instance,  corrosion  matter,  that  is  a  serious  problem  for  every  high  engineered  system,  in  airframes 
became  more  and  more  important  in  this  last  decade  when  aging  aircraft  subject  was  promoted  by  many 
different  factors,  most  of  them  afferent  to  economic  constraints1. 

Recently,  corrosion  contribution  to  the  aging  aircraft  related  costs  has  been  estimated  up  to  80%. 

On  the  other  hand  corrosion  problems  also  have  an  heavy  impact  on  safety  and  about  45%  of  the  observed 
component  failure  can  be  ascribed  to  corrosion,  when  both  direct  and  initiation  effects  are  considered. 

Corrosion  in  airframes  is  mainly  an  electrochemical  matter,  where  an  electrically  conducting  solution  assists 
the  transfer  of  metal  ions,  dry  corrosion  being  almost  always  limited  to  engine  components. 

In  spite  of  this  limitation,  a  lot  of  different  forms  can  be  observed  and  one  of  the  most  useful  theory  that  can 
be  used  to  categorize  them  is  the  Structural-Electrochemical  one2. 

In  agreement  with  this  theory,  the  driving  force  of  an  electrochemical  corrosion  process  must  be  considered 
the  presence  of  heterogeneity  on  the  metal  surface. 

Depending  on  the  nature  and  the  dimension  of  this  nonuniformity  three  different  categories  of  corrosion  must 
be  experienced: 

Uniform  corrosion,  in  presence  of  sub-microstructural  heterogeneity  from  1  to  1000  A,  comparable  to  the 
cristallographic  lattice  dimensions  (i.e.  differences  in  the  position  of  atoms,  thermal  fluctuations  of  metal  ions 
in  solution,  etc.). 

Selective  corrosion,  in  presence  of  microscopic  inhomogeneities  from  0,1  m  to  1  mm,  comparable  to  the  size 
of  the  cristallographic  structure  of  the  metal  (i.e.  grain  boundaries,  second  phases  in  alloys,  etc.). 

Localized  corrosion,  in  presence  of  macroscopic  inhomogeneities  greater  than  1  mm,  comparable  to  the  size 
of  the  component  (i.e.  galvanic  coupling,  differential  aeration,  etc.). 

3.  UNIFORM  CORROSION 

Here,  the  inhomogeneities  on  the  metal  surface  interacting  with  an  aggressive  environment,  are  so  small  in 
dimension  and  potential  that  the  same  area  will  change,  playing  continuously  a  different  anodic  and  cathodic 
role. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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The  total  effect  is  an  attack  on  the  whole  surface  leading  to  a  uniform  or  quasi-uniform  lost  in  depth  of  the 
metal. 

Although  this  is  a  very  common  mechanism  in  many  corroded  systems,  it  is  not  so  often  observed  on 
airframes  because  the  chosen  aeronautical  materials  are  always  less  prone  to  it. 

Uniform  corrosion  is  usual  for  non-stainless  steel  and  iron  where  it  can  be  easily  recognized  by  red  rust. 

Being  easily  detected  and  forecasted  uniform  corrosion  can’t  be  considered  as  a  very  dangerous  form  of 
corrosion. 

Usually  general  attack  occurs  on  parts  where  the  original  protective  coating  has  failed  for  any  reason.  The 
most  typical  case  is  certainly  observed  on  cadmium  plated  steels  after  the  anodic  coating  has  been  totally 
sacrificed  (Fig.  1). 


Fig.  1  -  Uniform  Corrosion  on  a  cadmium  plated  AM-X  Air  Combustion  Chamber 

Erosion,  caused  by  the  action  of  a  fast  moving  fluid,  can  also  lead  to  a  uniform  or  quasi-uniform  attack.  This 
specific  mechanism,  called  erosion-corrosion,  becomes  more  severe  in  aircraft  operating  in  hot  desert 
climates,  where  an  high  humidity  content,  especially  in  night  time,  is  associated  with  sand:  the  solid  particle 
content,  furthermore  rich  in  salt,  acts  as  an  extremely  abrasive  media,  removing  paint,  surface  finish  and 
corrosion  products,  offering  continuously  new  metal  surface. 

Aging  aircraft  issues  exacerbate  uniform  corrosion  problems  on  electrical  and  avionics  equipment  where,  in 
order  to  obtain  the  requested  performance,  materials  are  often  inferior  in  terms  of  corrosion  resistance. 

4.  SELECTIVE  CORROSION 

In  this  category  are  included  all  the  phenomena  depending  on  the  presence  of  heterogeneities  in  chemical 
composition.  In  this  sense  we  can  also  talk  about  this  electrochemical  attack  as  caused  by  an  intrinsic 
heterogeneity  of  the  material. 

4.1  Intergranular  Corrosion 

On  airframes,  intergranular  corrosion  (Fig.  2)  is  the  more  often  observed  mechanism  of  this  class  because  it  is 
characteristic  for  the  aluminum  alloys,  both  the  Al-Cu  (2xxx)  and  the  Al-Zn  (7xxx)  alloys,  where  the  driving 
force  for  the  electrochemical  process  is  the  difference  in  potential  between  the  second  phases  (richer  in  copper 
-  more  noble  -,  or  richer  in  zinc  -  less  noble  -)  and  the  aluminum  matrix. 
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Fig.  2  -  Intergranular  Corrosion  on  AA2024  (160x) 

In  this  case  corrosion  profile  follows  the  shape  of  grain  boundaries  (Fig.  3),  where  second  phases  are 
precipitated,  and  must  be  considered  very  dangerous  because,  in  spite  of  a  minimum  material  lost,  mechanical 
properties  fall  dramatically  down3.  Furthermore,  intergranular  corrosion  is  frequently  hard  to  detect  also  by 
means  of  NDE. 


Fig.  3  -  Intergranular  Corrosion  on  Mg  Alloy  AZ-91C  (250x) 
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When  intergranular  corrosion  occurs  on  heavily  rolled  or  extruded  parts  having  elongated  grains  in  the 
direction  of  working,  the  produced  phenomenon  has  the  very  characteristic  aspect  of  an  exfoliation  (Fig.  4). 


Fig.  4  -  Exfoliation  on  a  Breguet  Atlantic  Br.1150  AA2024  spar 

Intergranular  attack  can  also  be  observed  on  austenitic  stainless  steel.  On  these  materials  an  incorrect  cooling 
procedure  after  an  heat  treatment  can  lead  to  a  sensitization  of  the  part,  caused  by  the  grain  boundary 
precipitation  of  chromium  carbide  (Cr23C6)  and  according  to  this  the  strong  depletion  in  chromium  content 
of  the  contiguous  areas.  This  can  be  the  case  of  wrong  welding  procedures  (Fig.  5). 


Fig.  5  -  Low  Temperature  Sensitization  on  a  PH  17-7  Stainless  Steel 

4.2  Crystallographic  Corrosion 

Although  much  less  common  on  airframes,  another  kind  of  selective  attack  to  be  mentioned  is  the 
crystallographic  corrosion  which  can  be  generated  when  whole  grains  or  volumes  are  each  other 
electrochemically  different  enough. 

This  is  the  case  of  some  brasses  where  parts  richer  in  zinc  leave  the  metal  leading  to  a  spongy  structure. 
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5.  LOCALIZED  CORROSION 

This  is  certainly  the  class  where  the  widest  number  of  corrosion  mechanisms  are  observed. 

The  common  factor  among  the  different  forms  of  corrosion  in  the  case  of  a  localized  attack  is  the  presence  of 
stable  and  clearly  separate  cathodic  and  anodic  areas. 

5.1  Pitting  Corrosion 

Pitting  corrosion  is  a  dangerous  attack  which  occurs  on  passive  materials  when  the  protective  oxide  layer 
breaks. 

It  is  often  observed  on  stainless  steel  and  aluminum  alloys  that  spontaneously  form  a  protective  film:  as  a 
result  of  small  damages  on  the  passive  layer,  the  damaged  areas  will  work  as  anodes  immersed  in  a  very  large 
cathodic  area  and  will  suffer  in  consequence  of  this  a  very  localized  attack  which  leads  to  the  formation  of 
deep  and  narrow  cavities. 

Pitting  corrosion  is  particularly  common  on  aircraft  structures  operating  in  marine  environments,  since  the 
chloride  ions  and  halide  ions  in  general  promote  the  local  dissolution  of  protective  oxide  films. 

Here  following  (Fig.  6  and  7)  some  cases  occurred  in  the  recent  past  are  shown. 


Fig.  6  -  Pitting  Corrosion  on  a  HH-3F  Compressor  Blade 


Fig.  7  -  Pitting  Corrosion  on  MB-326  Balance  Tabs 

Some  authors4  include  in  pitting  corrosion  mechanism  also  those  corrosion  phenomena  that  take  place  on 
active  metals,  previously  protected  by  a  suitable  external  coating,  when  the  protection  is  locally  damaged. 
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In  any  case  pitting  must  be  considered  very  insidious  since  it  tends  to  accelerate  its  corrosion  rate  because  of 
the  increasing  acidity  and  chloride  content  inside  the  cavity;  furthermore,  in  highly  loaded  structures,  the 
stress  concentration  at  the  base  of  a  pit  is  often  sufficient  to  promote  fatigue  or  stress  corrosion  cracking. 

5.2  Crevice  Corrosion 

This  form  of  attack  (Fig.  8)  is  originated  by  the  difference  in  the  concentration  of  dissolved  oxidant  agent 
(usually  oxygen)  inside  and  outside  a  crevice.  In  this  case  the  area  inside  the  crevice  will  act  as  anodic  and 
there  a  pit  will  develop. 


Fig.  8  -  Crevice  Corrosion  on  Tornado 

In  airframes,  corrosion  crevice  is  frequently  observed  on  lap  joints  or  under  surface  deposits  in  presence  of 
stagnant  solution.  It  is  usually  associated  with  a  poor  performance  of  the  sealant  or  sometimes  can  be  caused 
by  a  defect  of  design  (i.e.  poor  drainage  conditions). 

Its  nature  makes  it  dangerous  because  often  occur  on  unexpected  areas  and  can’t  be  detected  by  visual 
inspection  if  not  disassembling. 

5.3  Galvanic  Corrosion 

Galvanic  corrosion  is  the  most  evident  form  of  localized  attack,  where  anodic  and  cathodic  areas  are  very 
clearly  identified. 

It  occurs  when  two  metals  of  different  electrochemical  potential  are  in  contact  in  a  corrosive  medium  and  the 
resulting  damage  to  the  less  noble  metal  will  be  more  severe  than  if  it  was  exposed  alone  to  the  same  medium. 
The  extension  of  the  corroded  area  on  the  anode  as  far  as  the  corrosion  rate  will  depend  on  the  difference  in 
the  electrochemical  potential  between  the  metals  and  the  conductivity  of  the  aggressive  medium.  Anyway,  the 
corrosion  attack  will  be  more  concentrated  in  the  part  of  the  anodic  metal  closest  to  the  cathode. 

In  aircraft  structures  is  often  necessary  to  use  different  metals  and  galvanic  corrosion  can’t  be  completely 
avoided.  In  this  case  is  important  to  take  care  about  the  ratio  between  the  cathode  and  the  anode:  increasing 
the  ratio  the  corrosion  will  tend  to  be  superficial. 

This  is  the  typical  example  occurring  at  fastener  holes  in  aluminum  alloy  skin  when  steel  bolts  or  rivets  are 
used. 

Looking  at  the  galvanic  series  it’s  easy  to  realize  that  magnesium  alloys  are  very  susceptible  to  suffer  galvanic 
attack  when  used  in  junction  with  any  other  metal  (Fig.  9-11). 
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Fig.  9  -  Galvanic  Corrosion  on  a  Mg  Alloy  Spacer, 
coupled  with  a  steel  beam  in  the  MB-326  Central  Section 


Fig.  10  -  Galvanic  Corrosion  on  the  MB-339  between  Mg  Alloy  Trim  and  Aluminum  rivets 
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Fig.  11  -  Galvanic  Corrosion  on  the  MB-339  Attach  Fitting 


5.4  Filiform  Corrosion 

Filiform  corrosion  (Fig.  12)  can  be  found  under  organic  coatings  such  as  paints,  due  to  penetration  of  moisture 
through  the  coated  surface  under  specific  temperature  (T  >  30  °C)  and  humidity  conditions  (Hr  >85%). 


Fig.  12  -  Intergranular  Corrosion  on  Aluminum  Alloy 


This  mechanism  is  not  particularly  dangerous  on  itself  since  it  propagates  creating  blistering  “wires”  of 
corrosion  products  on  the  surface  of  the  metal,  actives  just  on  the  tip  of  each  wire,  but  can  degenerates  in  more 
serious  attacks  if  not  detected  and  removed  in  an  early  stage. 

5.5  Stress  Corrosion  Cracking  (SCC)  and  Corrosion-Fatigue 

These  two  dangerous  localized  corrosion  mechanisms  are  often  unfortunately  observed  on  airframes. 

Both  produce  cracks,  different  in  shapes  and  patterns,  whom  growth  is  caused  by  the  synergetic  action  of  a 
moderate  corrosive  environment  and  a  mechanical  stress:  a  static  load  (lower  than  the  material’s  yield  tensile 
stress)  in  the  case  of  SCC  (Fig.  13),  or  a  cyclic  load  in  the  case  of  corrosion-fatigue  (lower  than  the  material’s 
fatigue  limit). 
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Fig.  13  -  Stress  Corrosion  Cracking  on  a  Br.1150  bomb  bay  guide  rail 

Many  models  have  been  proposed5  to  explain  the  crack  growth  process  for  these  attacks,  all  of  them 
coinciding  that  just  the  crack  tip  is  anodic  while  the  rest  of  the  metal  (including  the  walls  of  the  crack)  act  as 
cathodic. 

Once  the  crack  has  formed  it  will  continue  to  grow,  stopping  only  when  the  static  (SCC)  or  the  cyclic 
(corrosion-fatigue)  load  has  fallen  below  the  critical  value,  or  alternatively  excluding  the  corrosive 
environment. 

These  forms  of  corrosion  must  be  considered  as  a  major  problem  in  aging  airframe  related  issues,  particularly 
corrosion-fatigue  at  low  frequency  cyclic  stresses,  where  the  time  dependent  corrosion  process  has  the 
opportunity  to  explicate  its  action. 

In  effect  Multiple  Side  Damage,  a  phenomenon  under  intensive  investigation  since  the  last  ten  years,  can  often 
be  seen  as  an  extension  of  the  corrosion-fatigue  mechanism. 

5 . 6  Hydrogen  Embrittlement 

Hydrogen  embrittlement  is  often  considered  as  a  special  case  of  the  more  general  SCC  mechanism6. 

Its  effect  is  to  lower  the  ductility  in  metals  when  penetrated  into  the  material7  by  means  of  a  natural  corrosion 
reaction  or,  more  often,  during  a  plating  or  a  pickling  process. 

High  strength  steel  and  austenitic  stainless  steel  are  the  most  commonly  affected  aerospace  materials,  their 
susceptibility  also  depending  on  the  metal  composition8. 

Parts  more  often  failed  for  hydrogen  embrittlement  are  bolts  and  main  landing  gear  items. 

5.7  Fretting 

Fretting  is  an  insidious  form  of  corrosion  that  occurs  when  the  environmental  action  is  assisted  by  material 
wear  under  low  vibratory  relative  mote  of  parts. 

The  abrasion  of  the  surface  finishing,  and  after  that  of  the  corrosion  products,  continuously  offer  new  metal 
surface  to  the  environmental  aggressive  attack:  because  of  the  abrasive  nature  of  the  corrosion  products,  this 
mechanism  is  rate  increasing,  usually  leading  to  hemispheric  pits  where  fatigue  marks  are  often  found  on  their 
bottom  (fig.  14). 
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Fig.  14  -  Fretting  Corrosion  on  the  MB.339  Landing  Gear  spine 


6.  CONCLUSIONS 

This  lecture  has  given  a  compendium  of  the  deterioration  phenomena  induced  by  corrosion  most  frequently 
observed  on  airframes. 

The  scheme  followed  in  the  presentation  of  the  corrosion  forms  was  derived  from  the  Structural- 
Electrochemical  theory,  in  order  to  clarify  some  aspects  common  to  different  corrosion  mechanisms. 

An  always  increasing  knowledge  of  the  corrosion  problems,  based  on  the  past  experiences  and  on  a 
multidisciplinary  approach  comprehensive  of  design  philosophy,  condition  based  maintenance  and  NDE 
development,  is  then  essential  to  win  the  new  economic  and  safety  challenges  offered  by  the  aging  concerns. 
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Abstract:  Inspection  of  both  airframes  and  engines  is  a  key  activity  in  maintaining  continuing  airworthiness. 
Unless  structural  defects  are  detected  at  the  appropriate  time,  structural  failure  may  result.  The  reliability  of 
the  inspection  system  must  be  known  in  order  to  schedule  safe  inspection  intervals.  However,  inspection 
reliability  necessarily  includes  human  inspector  reliability  so  that  knowledge  of  human  inspection  performance 
is  vital  to  safety.  This  paper  describes  models  of  the  major  functions  of  the  human  inspector,  and  applies  these 
within  a  framework  of  inspection  reliability.  From  these  models,  and  field  experiments  on  inspectors  a  set  of 
factors  known  to  affect  inspection  reliability  is  derived.  These  can  be  used  to  define  good  practices  necessary 
to  continuously  improve  inspection  performance. 

1.  Introduction:  Inspection  plays  a  critical  role  in  airworthiness  assurance.  It  is  used  as  the  detection  system 
for  required  maintenance  procedures  and  as  a  final  check  that  the  maintenance  has  been  performed  correctly. 
Inspection  failure  at  either  stage  can  compromise  public  safety.  A  critical  defect  may  remain  undetected  and 
thus  unrepaired,  or  on  aircraft  with  a  procedural  error  (e.g.  a  missing  lock- wire)  may  be  released  for  service. 

These  issues  have  been  demonstrated  in  dramatic  fashion  in  aircraft  accidents.  In  1988  an  Aloha  Airlines  B- 
737  aircraft  suffered  fuselage  failure  from  undetected  multi-site  damage.  In  addition  to  aircraft  structures, 
inspection  errors  have  caused  engine  failures,  for  example  the  JT8-D  failure  on  takeoff  on  a  Delta  flight  from 
Pensacola  in  1998.  In  both  instances  the  inspection  technique  was  technically  capable  of  detecting  the  defect 
(a  crack)  but  the  overall  system  of  technology-plus-human  inspector  failed.  These  incidents  focused  attention 
on  the  role  of  the  human  inspector  in  the  technology -plus-inspector  system. 

For  many  years  (see  Swain,  1990)  human  factors  engineers  had  been  quantifying  human  reliability  using 
techniques  derived  from  system  safety.  Fault  tree  analysis  (FTA)  and  Failures  Modes  and  Effects  Analysis 
(FMEA)  had  been  employed  to  determine  how  failures  in  the  human  components  of  a  system  affected  overall 
system  reliability.  This  set  of  techniques  was  first  applied  to  aircraft  inspection  by  Fock  and  Strutt  (1985), 
who  used  their  detailed  task  description  of  inspection  to  derive  potential  systems  improvements. 

Two  parallel  lines  of  research  also  impact  on  improving  human  reliability  in  inspection.  First,  for  many  years 
it  has  been  traditional  to  measure  inspection  system  reliability  in  terms  of  the  probability  of  detecting  defects 
with  specified  characteristics  under  carefully  controlled  conditions.  This  set  of  techniques  is  used  to  define  the 
inspection  system  capability,  particularly  for  non-destructive  inspection.  The  second  research  thread  has  been 
the  on-going  study  of  human  factors  in  industrial  and  medical  inspection.  Early  realization  that  industrial 
inspectors  were  not  perfectly  reliable  led  to  many  hundreds  of  studies  aimed  at  modeling  and  improving 
inspection  performance. 

This  paper  covers  the  modeling  and  improvement  of  aviation  inspection  performance,  treating  human  factors 
as  an  explicit  aspect  of  inspection  capability.  Parts  of  the  text  that  follow  are  modified  from  a  recent  report  on 
one  inspection  technique,  Fluorescent  Penetrant  Inspection  (FPI),  published  in  Drury  (1999). 

2.  NonDestructive  Inspection  (NDI)  Reliability:  Over  the  past  two  decades  there  have  been  many  studies  of 
human  reliability  in  aircraft  structural  inspection.  All  of  these  to  date  have  examined  the  reliability  of 
Nondestructive  Inspection  (NDI)  techniques,  such  as  eddy  current  or  ultrasonic  technologies. 

From  NDI  reliability  studies  have  come  human/machine  system  detection  performance  data,  typically 
expressed  as  a  Probability  of  Detection  (PoD)  curve,  e.g.  (Rummel,  1998).  This  curve  expresses  the  reliability 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects”,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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of  the  detection  process  (PoD)  as  a  function  of  a  variable  of  structural  interest,  usually  crack  length,  providing 
in  effect  a  psychophysical  curve  as  a  function  of  a  single  parameter.  Sophisticated  statistical  methods  (e.g. 
Hovey  and  Berens,  1988)  have  been  developed  to  derive  usable  PoD  curves  from  relatively  sparse  data. 
Because  NDI  techniques  are  designed  specifically  for  a  single  fault  type  (usually  cracks),  much  of  the  variance 
in  PoD  can  be  described  by  just  crack  length  so  that  the  PoD  is  a  realistic  reliability  measure.  It  also  provides 
the  planning  and  life  management  processes  with  exactly  the  data  required,  as  structural  integrity  is  largely  a 
function  of  crack  length. 

A  typical  PoD  curve  has  low  values  for  small  cracks,  a  steeply  rising  section  around  the  crack  detection 
threshold,  and  level  section  with  a  PoD  value  close  to  1.0  at  large  crack  sizes.  It  is  often  maintained  (e.g. 
Panhuise,  1989)  that  the  ideal  detection  system  would  have  a  step-function  PoD:  zero  detection  below 
threshold  and  perfect  detection  above.  In  practice,  the  PoD  is  a  smooth  curve,  with  the  50%  detection  value 
representing  mean  performance  and  the  slope  of  the  curve  inversely  related  to  detection  variability.  The  aim 
is,  of  course,  for  a  low  mean  and  low  variability.  In  fact,  a  traditional  measure  of  inspection  reliability  is  the 
“90/95”  point.  This  is  the  crack  size  that  will  be  detected  90%  of  the  time  with  95%  confidence,  and  thus  is 
sensitive  to  both  the  mean  and  variability  of  the  PoD  curve. 

In  NDI  reliability  assessment  the  model  of  detecting  a  signal  in  noise  is  one  very  useful  model.  Other  models 
of  the  process  exist  (Drury,  1992)  and  have  been  used  in  particular  circumstances.  The  signal  and  noise  model 
assumes  that  the  probability  distribution  of  the  detector’s  response  can  be  modeled  as  two  similar  distributions, 
one  for  signal-plus-noise  (usually  referred  to  as  the  signal  distribution),  and  one  for  noise  alone.  (This  “Signal 
Detection  Theory”  has  also  been  used  as  a  model  of  the  human  inspector,  see  Section  3.1).  For  given  signal 
and  noise  characteristics,  the  difficulty  of  detection  will  depend  upon  the  amount  of  overlap  between  these 
distributions.  If  there  is  no  overlap  at  all,  a  detector  response  level  can  be  chosen  which  completely  separates 
signal  from  noise.  If  the  actual  detector  response  is  less  than  the  criterion  or  “signal”  and  if  it  exceeds 
criterion,  this  “criterion”  level  is  used  by  the  inspector  to  respond  “no  signal.”  For  non-overlapping 
distributions,  perfect  performance  is  possible,  i.e.  all  signals  receive  the  response  “signal”  for  100%  defect 
detection,  and  all  noise  signals  receive  the  response  “no  signal”  for  0%  false  alarms.  More  typically,  the  noise 
and  signal  distributions  overlap,  leading  to  less  than  perfect  performance,  i.e.  both  missed  signals  and  false 
alarms. 

The  distance  between  the  two  distributions  divided  by  their  (assumed  equal)  standard  deviation  gives  the 
signal  detection  theory  measure  of  discriminability.  A  discriminability  of  0  to  2  gives  relatively  poor 
reliability  while  discriminabilities  beyond  3  are  considered  good.  The  criterion  choice  determines  the  balance 
between  misses  and  false  alarms.  Setting  a  low  criterion  gives  very  few  misses  but  large  numbers  of  false 
alarms.  A  high  criterion  gives  the  opposite  effect.  In  fact,  a  plot  of  hits  (1  -  misses)  against  false  alarms  gives 
a  curve  known  as  the  Relative  Operating  Characteristic  (or  ROC)  curve  which  traces  the  effect  of  criterion 
changes  for  a  given  discriminability  (see  Rummell,  Hardy  and  Cooper,  1989). 

The  NDE  Capabilities  Data  Book  (1997)  defines  inspection  outcomes  as: 


NDE  Signal 

Flaw  Presence 

Positive 

Negative 

Positive 

True  Positive 

No  Error 

False  Positive 

Type  2  Error 

Negative 

False  Negative 

Type  1  Error 

True  Negative 

No  Error 

And  defines 


PoD  =  Probability  of  Detection  = 


TruePositives 


TruePositives  +FalseNegatives 


PoFA  =  Probability  of  False  Alarm  = 


FalsePositives 


TrueNegatives  +  FalsePositives 
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The  ROC  curve  traditionally  plots  PoD  against  (1  -  PoFA).  Note  that  in  most  inspection  tasks,  and 
particularly  for  engine  rotating  components,  the  outcomes  have  very  unequal  consequences.  A  failure  to 
detect  (1  -  PoD)  can  lead  to  engine  failure,  while  a  false  alarm  can  lead  only  to  increased  costs  of  needless 
repeated  inspection  or  needless  removal  from  service. 

This  background  can  be  applied  to  any  inspection  process,  and  provides  the  basis  of  standardized  process 
testing.  It  is  also  used  as  the  basis  for  inspection  policy  setting  throughout  aviation.  The  size  of  crack  reliably 
detected  (e.g.  90/95  criterion),  the  initial  flaw  size  distribution  at  manufacture  and  crack  growth  rate  over  time 
can  be  combined  to  determine  an  interval  between  inspections  which  achieves  a  known  balance  between 
inspection  cost  and  probability  of  component  failure. 

The  PoD  and  ROC  curves  differ  between  different  techniques  of  NDI  (including  visual  inspection)  so  that  the 
technique  specified  has  a  large  effect  on  probability  of  component  failure.  The  techniques  of  ROC  and  PoD 
analysis  can  also  be  applied  to  changing  the  inspection  configuration,  for  example  the  quantitative  study  of 
multiple  FPI  of  engine  disks  by  Yang  and  Donath  (1983). 

Probability  of  detection  is  not  just  a  function  of  crack  size,  or  even  of  NDI  technique.  Early  work  by  Rummel, 
Rathke,  Todd  and  Mullen  (1975)  demonstrated  that  FPI  of  weld  cracks  was  sensitive  to  metal  treatment  after 
manufacture.  The  detectable  crack  size  was  smaller  following  a  surface  etch  and  smaller  still  following  proof 
loading  of  the  specimen.  This  points  to  the  requirement  to  examine  closely  all  of  the  steps  necessary  to  inspect 
an  item,  and  not  just  those  involving  the  inspector. 

3.  Human  Factor  in  Inspection:  Human  factors  studies  of  industrial  inspection  go  back  to  the  1950’s  when 
psychologists  attempted  to  understand  and  improve  this  notoriously  error-prone  activity.  From  this  activity 
came  literature  of  increasing  depth  focusing  an  analysis  and  modeling  of  inspection  performance,  which 
complemented  the  quality  control  literature  by  showing  how  defect  detection  could  be  improved.  Two  early 
books  brought  much  of  this  accumulated  knowledge  to  practitioners:  Harris  and  Chaney  (1969)  and  Drury  and 
Fox  (1975).  Much  of  the  practical  focus  at  that  time  was  on  enhanced  inspection  techniques  or  job  aids,  while 
the  scientific  focus  was  on  application  of  psychological  constructs,  such  as  vigilance  and  signal  detection 
theory,  to  modeling  of  the  inspection  task. 

As  a  way  of  providing  a  relevant  context,  we  use  the  generic  functions  which  comprise  all  inspection  tasks 
whether  manual,  automated  or  hybrid  (Drury,  1992).  Table  1  shows  these  functions,  with  an  example  from 
fluorescent  penetrant  inspection.  We  can  go  further  by  taking  each  function  and  listing  its  correct  outcome, 
from  which  we  can  logically  derive  the  possible  errors  (Table  2). 

Table  1.  Generic  Task  Description  of  Inspection  Applied  to  Fluorescent  Penetrant  Inspection. 


Function 

Description 

1.  Initiate 

All  processes  up  to  visual  examination  of  component  in  reading  booth.  Get  and  read 
workcard.  Check  part  number  and  serial  number.  Prepare  inspection  tools.  Check  booth 
lighting.  Wait  for  eyes  to  adapt  to  low  light  level. 

2.  Access 

Position  component  for  inspection.  Reposition  as  needed  throughout  inspection. 

3.  Search 

Visually  scan  component  to  check  cleaning  adequacy.  Carefully  scan  component  using  a 
good  strategy.  Stop  search  if  an  indication  is  found. 

4.  Decision 

Compare  indication  to  standards  for  crack.  Use  re-bleed  process  to  differentiate  cracks 
from  other  features.  Confirm  with  white  light  and  magnifying  loupe. 

5.  Response 

If  cleaning  is  below  standard,  then  return  to  cleaning.  If  indication  confirmed,  then  mark 
extent  on  component.  Complete  paperwork  procedures  and  remove  component  from  booth. 

Humans  can  operate  at  several  different  levels  in  each  function  depending  upon  the  requirements.  Thus,  in 
Search,  the  operator  functions  as  a  low-level  detector  of  indications,  but  also  as  a  high-level  cognitive 
component  when  choosing  and  modifying  a  search  pattern.  It  is  this  ability  which  makes  humans  uniquely 
useful  as  self-reprogramming  devices,  but  equally  it  leads  to  more  error  possibilities.  As  a  framework  for 
examining  inspection  functions  at  different  levels  the  skills/rules/knowledge  classification  of  Rasmussen 
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(1983)  will  be  used.  Within  this  system,  decisions  are  made  at  the  lowest  possible  level,  with  progression  to 
higher  levels  only  being  invoked  when  no  decision  is  possible  at  the  lower  level. 

For  most  of  the  functions,  operation  at  all  levels  is  possible.  Presenting  an  item  for  inspection  is  an  almost 
purely  mechanical  function,  so  that  only  skill-based  behavior  is  appropriate.  The  response  function  is  also 
typically  skill-based,  unless  complex  diagnosis  of  the  defect  is  required  beyond  mere  detection  and  reporting. 


Table  2.  Generic  Function,  Outcome,  and  Error  Analysis  of  Test  Inspection. 


Function 

Outcome 

Logical  Errors 

Initiate 

Inspection  system  functional,  correctly 
calibrated  and  capable. 

1 . 1  Incorrect  equipment 

1.2  Non- working  equipment 

1.3  Incorrect  calibration 

1.4  Incorrect  or  inadequate  system  knowledge 

Access 

Item  (or  process)  presented  to  inspection 
system 

2.1  Wrong  item  presented 

2.2  Item  mis-presented 

2.3  Item  damaged  by  presentation 

Search 

Individuals  of  all  possible  non-conformities 
detected,  located 

3.1  Indication  missed 

3.2  False  indication  detected 

3.3  Indication  mis-located 

3.4.  Indication  forgotten  before  decision 

Decision 

All  individuals  located  by  Search,  correctly 
measured  and  classified,  correct  outcome 
decision  reacted 

4.1  Indication  incorrectly  measured/confirmed 

4.2  Indication  incorrectly  classified 

4.3  Wrong  outcome  decision 

4.4  Indication  not  processed 

Response 

Action  specified  by  outcome  decision  taken 
correctly 

5.1  Non-conforming  action  taken  on  conforming  item 

5.2  Conforming  action  taken  on  non-conforming  item 

3.1  Critical  Functions:  search  and  decision:  The  functions  of  search  and  decision  are  the  most  error-prone  in 
general,  although  for  much  of  NDI,  setup  can  cause  its  own  unique  errors.  Search  and  decision  have  been  the 
subjects  of  considerable  mathematical  modeling  in  the  human  factors  community,  with  direct  relevance  to 
airframe  and  engine  inspection. 

In  FPI,  visual  inspection  and  X-ray  inspection,  the  inspector  must  move  his/her  eyes  around  the  item  to  be 
inspected  to  ensure  that  any  defect  will  eventually  appear  within  an  area  around  the  line  of  sight  in  which  it  is 
possible  to  have  detection.  This  area,  called  the  visual  lobe,  varies  in  size  depending  upon  target  and 
background  characteristics,  illumination  and  the  individual  inspector’s  peripheral  visual  acuity.  As  successive 
fixations  of  the  visual  lobe  on  different  points  occur  at  about  three  per  second,  it  is  possible  to  determine  how 
many  fixations  are  required  for  complete  coverage  of  the  area  to  be  searched. 


Eye  movement  studies  of  inspectors  show  that  they  do  not  follow  a  simple  pattern  in  searching  an  object. 
Some  tasks  have  very  random  appearing  search  patterns  (e.g.,  circuit  boards),  whereas  others  show  some 
systematic  search  components  in  addition  to  this  random  pattern  (e.g.,  knitwear).  However,  all  who  have 
studied  eye  movements  agree  that  performance,  measured  by  the  probability  of  detecting  an  imperfection  in  a 
given  time,  is  predictable  assuming  a  random  search  model.  The  equation  relating  probability  (p{)  of 
detection  of  an  imperfection  in  a  time  (t)  to  that  time  is 


Pt 


f 

1-exp 

V 


t  > 


where  t  is  the  mean  search  time.  Further,  it  can  be  shown  that  this  mean  search  time  can  be  expressed  as 


apn 
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where 

tQ  =  average  time  for  one  fixation 

A  =  area  of  object  searched 

a  =  area  of  the  visual  lobe 

p  =  probability  that  an  imperfection  will  be  detected  if  it  is  fixated.  (This  depends  on  how  the  lobe  (a) 
is  defined.  It  is  often  defined  such  that  p  =  !4.  This  is  an  area  with  a  50%  chance  of  detecting  an 
imperfection. 

n  =  number  of  imperfections  on  the  object. 

From  these  equations  we  can  deduce  that  there  is  speed/accuracy  tradeoff  (SATO)  in  visual  search,  so  that  if 
insufficient  time  is  spent  in  search,  defects  may  be  missed.  We  can  also  determine  what  factors  affect  search 
performance,  and  modify  them  accordingly.  Thus  the  area  to  be  searched  (A)  is  a  direct  driver  of  mean  search 
time.  Anything  we  can  do  to  reduce  this  area,  e.g.  by  instructions  about  which  parts  of  an  object  not  to  search, 
will  help  performance.  Visual  lobe  area  needs  to  be  maximized  to  reduce  mean  search  time,  or  alternatively  to 
increase  detection  for  a  given  search  time.  Visual  lobe  size  can  be  increased  by  enhancing  target  background 
contrast  (e.g.  using  the  correct  developer  in  FPI)  and  by  decreasing  background  clutter  (e.g.  by  more  careful 
cleaning  before  FPI).  It  can  also  be  increased  by  choosing  operators  with  higher  peripheral  visual  acuity 
(Eriksen,1990)  and  by  training  operators  specifically  in  visual  search  or  lobe  size  improvement  (Drury,  Prabhu 
and  Gramopadhye,1990).  Research  has  shown  that  there  is  little  to  be  gained  by  reducing  the  time  for  each 
fixation,  tQ  ,  as  it  is  not  a  valid  selection  criterion,  and  cannot  easily  be  trained. 

The  equation  given  for  search  performance  assumed  random  search,  which  is  always  less  efficient  than 
systematic  search.  Human  search  strategy  has  proven  to  be  quite  difficult  to  train,  but  recently  Wang,  Lin  and 
Drury  (1997)  showed  that  people  can  be  trained  to  perform  more  systematic  visual  search.  Also, 
Gramopadhye,  Prabhu  and  Sharit  (1997)  showed  that  particular  forms  of  feedback  can  make  search  more 
systematic. 

Decision-making  is  the  second  key  function  in  inspection.  An  inspection  decision  can  have  four  outcomes,  as 
shown  in  Table  3.  These  outcomes  have  associated  probabilities,  for  example  the  probability  of  detection  is 
the  fraction  of  all  nonconforming  items  which  are  rejected  by  the  inspector  shown  as  p2  in  Table  3. 

Table  3.  Attributes  Inspection  Outcomes  and  Probabilities. 


True  State  of  Item 

Decision  of  Inspector 

Conforming 

Nonconforming 

Accept 

Correct  accept,  px 

Miss,  (1  -  p2) 

Reject 

False  alarm,  (1  -  px) 

Hit,  p2 

Just  as  the  four  outcomes  of  a  decision-making  inspection  can  have  probabilities  associated  with  them,  they 
can  have  costs  and  rewards  also:  costs  for  errors  and  rewards  for  correct  decisions.  Table  4  shows  a  general 
cost  and  reward  structure,  usually  called  a  “payoff  matrix,”  in  which  rewards  are  positive  and  costs  negative.  A 
rational  economic  maximizer  would  multiply  the  probabilities  of  Table  3  by  the  corresponding  payoffs  in 
Table  4  and  sum  them  over  the  four  outcomes  to  obtain  the  expected  payoff.  He  or  she  would  then  adjust 
those  factors  under  his  or  her  control.  Basically,  SDT  states  that  px  and  p2  vary  in  two  ways.  First,  if  the 
inspector  and  task  are  kept  constant,  then  as  px  increases,  p2  decreases,  with  the  balance  between  px  and  p2 
together  by  changing  the  discriminability  for  the  inspector  between  acceptable  and  rejectable  objects.  px  and 
p2  can  be  changed  by  the  inspector.  The  most  often  tested  set  of  assumptions  comes  from  a  body  of 
knowledge  known  as  the  theory  of  signal  detection,  or  SDT  (McNichol,  1972).  This  theory  has  been  used  for 
numerous  studies  of  inspection,  for  example,  sheet  glass,  electrical  components,  and  ceramic  gas  igniters,  and 
has  been  found  to  be  a  useful  way  of  measuring  and  predicting  performance.  It  can  be  used  in  a  rather  general 
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nonparametric  form  (preferable)  but  is  often  seen  in  a  more  restrictive  parametric  form  in  earlier  papers  (Drury 
and  Addison,  1963).  McNichol  (1972)  is  a  good  source  for  details  of  both  forms. 

Table  4.  Payoff  Matrix  for  Attributes  Inspection. 


True  State  of  Item 

Decision  of  Inspector 

Conforming 

Nonconforming 

Accept 

A 

-b 

Reject 

-c 

D 

The  objective  in  improving  decision  making  is  to  reduce  decision  errors.  There  can  arise  directly  from 
forgetting  imperfections  or  standards  in  complex  inspection  tasks  or  indirectly  from  making  an  incorrect 
judgement  about  an  imperfection’s  severity  with  respect  to  a  standard.  Ideally,  the  search  process  should  be 
designed  so  as  to  improve  the  conspicuity  of  rejectable  imperfections  (nonconformities)  only,  but  often  the 
measures  taken  to  improve  conspicuity  apply  equally  to  nonrejectable  imperfections.  Reducing  decision  errors 
usually  reduces  to  improving  the  discriminability  between  imperfection  and  a  standard. 

Decision  performance  can  be  improved  by  providing  job  aids  and  training  which  increase  the  size  of  the 
apparent  difference  between  the  imperfections  and  the  standard  (i.e.  increasing  discriminability).  One  example 
is  the  provision  of  limit  standards  well  integrated  into  the  inspector’s  view  of  the  item  inspected.  Limit 
standards  change  the  decision-making  task  from  one  of  absolute  judgement  to  the  more  accurate  one  of 
comparative  judgement.  Harris  and  Chaney  (1969)  showed  that  limit  standards  for  solder  joints  gave  a  100% 
performance  improvement  in  inspector  consistency  for  near-borderline  cases. 

One  area  of  human  decision-making  that  has  received  much  attention  is  the  vigilance  phenomenon.  It  has 
been  known  for  half  a  century  that  as  time  on  task  increases,  then  the  probability  of  detecting  perceptually 
difficult  events  decreases.  This  has  been  called  the  vigilance  decrement  and  is  a  robust  phenomenon  to 
demonstrate  in  the  laboratory.  Detection  performance  decreases  rapidly  over  the  first  20-30  minutes  of  a 
vigilance  task,  and  remains  at  a  lower  level  as  time  or  task  increases.  Note  that  there  is  not  a  period  of  good 
performance  followed  by  a  sudden  drop:  performance  gradually  worsens  until  it  reaches  a  steady  low  level. 
Vigilance  decrements  are  worse  for  rare  events,  for  difficult  detection  tasks,  when  no  feedback  of  performance 
is  given,  and  where  the  person  is  in  social  isolation.  All  of  these  factors  are  present  to  some  extent  in  FPI,  so 
that  prolonged  vigilance  is  potentially  important  here. 

A  difficulty  arises  when  this  body  of  knowledge  is  applied  to  inspection  tasks  in  practice.  There  is  no 
guarantee  that  vigilance  tasks  are  good  models  of  inspection  tasks,  so  that  the  validity  of  drawing  conclusions 
about  vigilance  decrements  in  inspection  must  be  empirically  tested.  Unfortunately,  the  evidence  for 
inspection  decrements  is  largely  negative.  A  few  studies,  e.g.  for  chicken  carcass  inspection  (Chapman  and 
Sinclair,  1975)  report  positive  results  but  most,  e.g.  eddy  current  NDI  (Spencer  and  Schurman,  1995; 
Murgatroyd,  Worrall  and  Waites,  1994)  find  no  vigilance  decrement. 

It  should  be  noted  that  inspection  is  not  merely  the  decision  function.  The  use  of  models  such  as  signal 
detection  theory  to  apply  to  the  whole  inspection  process  is  misleading  in  that  it  ignores  the  search  function. 
For  example,  if  the  search  is  poor,  then  many  defects  will  not  be  located.  At  the  overall  level  of  the  inspection 
task,  this  means  that  PoD  decreases,  but  this  decrease  has  nothing  to  do  with  setting  the  wrong  decision 
criteria.  Even  such  devices  as  ROC  curves  should  only  be  applied  to  the  decision  function  of  inspection,  not  to 
the  overall  process  unless  search  failure  can  be  ruled  out  on  logical  grounds. 

4.  NDI/Human  Factors  Links:  As  noted  earlier,  human  factors  has  been  considered  for  some  time  in  NDI 
reliability.  This  often  takes  the  form  of  measures  of  inter-inspector  variability  (e.g.  Herr  and  Marsh,  1978),  or 
discussion  of  personnel  training  and  certification  (Herr  and  Marsh,  1978).  There  have  been  more  systematic 
applications,  such  as  Lock  and  Strutt’s  (1990)  classic  study  from  a  human  reliability  perspective,  or  the  initial 
work  on  the  FAA/Office  of  Aviation  Medicine  (AAM)  project  reported  by  Drury,  Prabhu  and  Gramopadhye 
(1990).  A  logical  task  breakdown  of  NDI  was  used  by  Webster  (1988)  to  apply  human  factors  data  such  as 
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vigilance  research  to  NDI  reliability.  He  was  able  to  derive  errors  at  each  stage  of  the  process  of  ultrasonic 
inspection  and  thus  propose  some  control  strategies. 

A  more  recent  example  from  visual  inspection  is  the  Sandia  National  Laboratories  (SNL/AANC)  experiment 
on  defect  detection  on  their  B-737  test  bed  (Spencer,  Drury  and  Schurman,  1996).  The  study  used  twelve 
experienced  inspectors  from  major  airlines,  who  were  given  the  task  of  visually  inspecting  ten  different  areas. 
Nine  areas  were  on  AANC’s  Boeing  737  test  bed  and  one  was  on  the  set  of  simulated  fuselage  panels 
containing  cracks  which  had  been  used  for  the  earlier  eddy-current  study. 

In  a  final  example  an  analysis  was  made  of  inspection  errors  into  search  and  decision  errors  (Table  5),  using  a 
technique  first  applied  to  turbine  engine  bearing  inspection  in  a  manufacturing  plant.  This  analysis  enables  us 
to  attribute  errors  to  either  a  search  failure  (inspector  never  saw  the  indication)  or  decision  failure  (inspector 
saw  the  indication  but  came  to  the  wrong  decision).  With  such  an  analysis,  a  choice  of  interventions  can  be 
made  between  measures  to  improve  search  or  (usually  different)  measures  to  improve  decision.  Such  an 
analysis  was  applied  to  the  eleven  inspectors  for  whom  usable  tapes  were  available  from  the  cracked  fuselage 
panels  inspection  task. 


Table  5.  Observed  NDI  errors  from  classified  by  their  function  and  cause  (Murgatroyd  et  al,  1994). 


Function 

Error  Type 

Etiology/Causes 

Miss 

False 

Alarm 

3.  Search 

3.1  Motor  failure  in 

Not  clamping  straight  edge 

X 

X 

probe  movement 

Mis-clamping  straight  edge 

X 

Speed/accuracy  tradeoff 

X 

3.2  Fail  to  search 

Stopped,  then  restarted  at  wrong  point 

X 

sub-area 

3.3  Fail  to  observe 

Distracted  by  outside  event 

X 

display 

Distracted  by  own  secondary  task 

X 

3.4  Fail  to  perceive 

Low-amplitude  signal 

X 

signal 

4.  Decision 

4.1  Fail  to  re-check 

Does  not  go  back  far  enough  in  cluster, 

area 

missing  first  defect 

4.2  Fail  to  interpret 

.Marks  nonsignals  with  ? 

X 

signal  correctly 

Notes  signals  but  interprets  it  as  noise 

X 

Mis-classifles  signal 

X 

X 

5.  Response 

5.2  Mark  wrong 

Marks  between  2  fasteners 

X 

rivet 

The  results  of  this  analysis  are  shown  in  Table  6.  Note  the  relatively  consistent,  although  poor,  search 
performance  of  the  inspectors  on  these  relatively  small  cracks.  In  contrast,  note  the  wide  variability  in 
decision  performance  shown  in  the  final  two  columns.  Some  inspectors  (e.g.  B)  made  many  misses  and  few 
false  alarms.  Others  (e.g.  F)  made  few  or  no  misses  but  many  or  even  all  false  alarms.  Two  inspectors  made 
perfect  decisions  (E  and  G).  These  results  suggest  that  the  search  skills  of  all  inspectors  need  improvement, 
whereas  specific  individual  inspectors  need  specific  training  to  improve  the  two  decision  measures. 
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Table  6.  Search  and  decision  failure  probabilities  on  simulated  fuselage  panel  inspection 
(derived  from  Spencer,  Drury  and  Schurman,  1996). 


Inspector 

Probability  of  Search 
Failure 

Probability  of 
Decision  Failure 
(miss) 

Probability  of  Decision  Failure 
(false  alarm)  1 

A 

0.31 

0.27 

0.14 

B 

0.51 

0.66 

0.11 

C 

0.47 

0.31 

0.26 

D 

0.44 

0.07 

0.42 

E 

0.52 

0.00 

0.00 

F 

0.40 

0.00 

1.00 

G 

0.47 

0.00 

0.00 

H 

0.66 

0.03 

0.84 

I 

0.64 

0.23 

0.80 

J 

0.64 

0.07 

0.17 

K 

0.64 

0.17 

0.22 

With  linkages  between  NDI  reliability  and  human  factors  such  as  these  given  above,  it  is  now  possible  to 
derive  a  more  detailed  methodology  for  this  project. 

5.  Practical  Issues  in  Inspection  Human  Factors:  As  can  be  seen  from  the  review  of  human  factors  in 
inspection,  a  number  of  interventions  is  derivable  from  models  and  field  data.  Human  factors  recognizes  that 
any  system  comprises  several  components  that  must  work  together  harmoniously  to  ensure  system 
performance  and  human  well  being.  There  have  been  several  proposed  taxonomies  of  system  components, 
including  ICAO’s  SHELL  model,  but  here  we  will  use  the  TOMES  model  for  simplicity:  Task/  Operator/ 
Machine/  Environment/  Social.  For  detailed  reference  on  each  see,  for  example  Drury  (1992). 

5.1  Task  Interventions.  The  task  comprises  all  of  the  steps  necessary  to  perform  the  inspection  reliability. 
Task  factors  affecting  performance  include: 

•  Time  available  for  task  completion.  Because  search  is  resource-limited,  overall  probability  of  detection  is 
very  sensitive  to  time  limitations.  In  particular,  external  pacing  of  inspection  tasks  increases  errors. 

•  Nature  of  defect.  Some  detects  are  inherently  more  difficult  to  find  than  others.  In  addition,  defect  size  is 
a  major  driver  of  probability  of  detection.  This  makes  early  detection  of  progressive  defects  such  as 
cracks  and  corrosion  difficult. 

•  Mix  of  defects.  If  the  inspector  must  search  simultaneously  for  several  defects,  performance  on  detecting 
any  particular  defect  decreases. 

•  Probability  of  a  defect.  As  noted  under  decision  models,  inspectors  have  a  higher  probability  of  detection 
where  a  defect  is  more  likely.  Conversely,  rare  defects  are  very  difficult  to  detect,  providing  an  ultimate 
limit  to  human  inspection  performance. 

5.2  Operator  Interventions.  The  operator  here  is  usually  the  inspector,  although  others  involved  for  example 
in  set-up  or  part  cleaning  may  also  be  operators. 

•  Selection  and  Placement.  Historically  there  has  been  a  continuing  interest  in  providing  tools  to  select  a 
“good”  inspector.  However,  such  efforts  have  been  largely  unsucessful  when  “good”  is  defined  in  terms 
of  detection  probability.  A  primary  reason  has  been  that  performance  of  inspectors  is  task-dependent,  with 
no  guarantee  that  an  inspector  who  performs  well  on  inspection  task  A  will  also  perform  well  on  task  B. 
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•  Training.  Human  factors  engineers  have  had  considerable  success  in  using  the  generic  inspection 
functions  (Tables  1,  2)  as  the  basis  for  improved  training.  Both  in  manufacturing  industry  (Kleiner  and 
Drury,  1993)  and  in  aviation  maintenance  (Gramopadhye,  Drury  and  Sharit,  1997)  such  training  must 
cover  search  strategy  as  well  as  decision  criteria  if  it  is  to  be  effective. 

5.3  Machine  Interventions .  Hardware  and  software  aspects  of  the  task  inspection. 

•  Inspection  object  handling.  If  the  component  inspected  is  difficult  to  reach  or  has  poor  visual  access, 
inspection  performance  will  suffer  to  some  extent.  Access  is  limited  by  aircraft  and  engine  design  factors, 
but  steps  can  be  taken  for  improvement.  Examples  include  customized  access  stands  for  airframe 
inspection,  easily  maneuverable  hangers  for  engine  components  and  improved  mirrors/loupes. 

•  Software  aspects  of  inspection  cover  the  design  of  documentation  such  as  workcards,  manuals  and  service 
bulletins.  Poor  wording  and  layout  of  these  documents,  or  their  computer  equivalents,  can  have  a  major 
effect  on  error  rates  (Patel,  Prabhu,  and  Drury,  1992). 

5.4  Environment  Interventions:  All  inspection  takes  place  in  a  physical  environment  (this  section)  and  a  social 
environment  (following  section). 

•  Visual  environment.  Obviously,  enough  light  must  be  available  for  inspection,  but  performance  typically 
depends  more  on  the  quality  of  the  visual  environment  than  the  intensity  of  illumination.  Lighting  must  be 
developed  to  maximize  the  probability  of  defect  detection. 

•  Other  environmental  factors.  Human  performance  decreases  in  adverse  noise  and  thermal  environments.  For 
inspectors,  such  adverse  conditions  are  common,  both  in  line  inspection  and  within  the  maintenance  hangar. 

5.5  Social  Interventions.  Inspection  is  part  of  a  socio-technical  system  of  aircraft  maintenance,  so  that 
relationships  between  the  inspector  and  others  will  influence  inspection  performance. 

•  Management  interactions.  If  inspectors’  decis-ions  are  contradicted  by  management,  then  the  inspectors  are 
likely  to  change  their  decision  criteria  for  reporting  defects  (see  Section  3.1).  Most  inspectors  are  fiercely 
independent,  and  their  departmental  managers  respect  this.  But  external  pressures  for  hurried  work  will  have 
obvious  effects  on  inspection  reliability. 

•  Peer  interactions.  Inspectors  hand  off  work  whenever  a  shift  changes  or  an  interruption  occurs.  The  handover 
procedures  have  been  implicated  in  incident  and  accident  reports  so  that  good  practices  need  to  be  followed 
whenever  ownership  of  a  job  changes. 

•  Working  hours.  Inspection  demands  continuous  vigilance,  which  is  a  cognitively  demanding  activity.  People 
do  not  perform  well  during  long  hours  of  work.  Nor  do  they  perform  well  when  sleep  patterns  are  disrupted. 
Yet  much  inspection  is  carried  out  on  night  shifts,  and  large  amounts  of  overtime  are  common  during  initial 
inspection.  Neither  practice  helps  inspection  reliability. 

6.  Conclusions:  Airframe  and  engine  inspection  is  a  complex  activity  dependent  upon  its  human  and  hardware 
components  alike  for  its  reliability.  Human  factors  engineers  have  developed  useful  models  of  the  generic 
tasks  in  inspection.  Such  models  can  be  used  both  to  guide  field  investigation  of  inspection  tasks  and  to 
predict  those  factors  having  the  greatest  impact  on  inspection  reliability.  Using  this  approach  it  is  possible  to 
derive  good  practices  to  improve  inspection  performance.  For  one  unique  inspection  task,  Fluorescent 
Penetrant  Inspection,  a  set  of  good  practices  has  been  derived  and  is  available  at  www.hfskywav.com. 

7.  Acknowledgement:  This  work  was  performed  under  contract  from  the  Office  of  Aviation  Medicine  (Ms. 
Jean  Watson),  Federal  Aviation  Administration. 
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Summary 

After  providing  some  commonly  used  definitions  of  fracture  critical  parts,  the  influence  of  improved  calculation 
methods  on  the  design  of  such  components  is  shown.  Various  approaches  to  the  determination  of  usable  fatigue  life  are 
discussed,  particularly  the  classical  safe  life  philosophy  and  approaches  exploiting  the  damage  tolerance  of  compo¬ 
nents.  Within  this  general  framework  there  exist  various  possible  lifing  policies,  that  have  to  be  discussed  and  agreed 
between  the  engine  manufacturer,  the  users  and  the  regulatory  agencies.  The  methods  for  life  usage  management  may 
be  adapted  to  changing  environments,  taking  into  account  the  experience  gained  during  operational  usage.  The  intro¬ 
duction  of  recording  or  monitoring  systems  makes  it  possible  to  calculate  the  actual  life  usage  of  individual  compo¬ 
nents  or  at  least  to  determine  the  scatter  of  usage  within  an  aircraft  fleet.  These  results  enable  a  specific  exploitation 
of  the  life  potential  of  the  parts  without  giving  rise  to  an  increased  risk.  The  use  of  the  life  potential  beyond  the  safe 
crack  initiation  life  requires  experimental  and  computational  methods  to  gain  insight  into  the  fracture  mechanical 
processes  governing  crack  propagation.  The  corresponding  results  can  also  be  used  to  determine  inspection  intervals 
that  ensure  a  detection  of  cracks  before  those  cracks  start  uncontrolled  growth.  Results  from  an  on-board  life  usage 
monitoring  system  used  by  the  German  air  force  are  presented.  An  outline  of  the  tasks  of  usage  monitoring  is  given. 
Finally  some  remarks  on  fleet  management  are  presented. 

Introduction 

A  considerable  percentage  of  the  military  aircraft  and  engines  now  in  use  have  experienced  operation  over  usage  times 
not  foreseen  when  those  engines  were  designed.  In  Germany  we  have  the  F-4F  (Phantom  II),  designed  around  1965, 
that  entered  service  at  the  German  air  force  in  1974  with  its  J79  engine.  The  same  engine  also  powers  the  F-104S-ASU 
(Starfighter)  still  in  use  at  the  Italian  air  force.  Both  types  will  continue  to  fly  until  being  replaced  by  the  Eurofighter. 
The  French  air  force  continues  to  use  the  Alphajet  and  the  Mirage  FI,  both  with  engines  designed  in  the  early  70’s. 
Although  many  of  the  older  MiG  and  Su  types  have  been  withdrawn  from  service  in  the  last  years,  there  remains  a 
large  amount  of  aircraft  that  have  seen  more  than  a  quarter  of  a  century  of  operation  in  the  air  forces  of  Eastern 
Europe.  The  vast  majority  of  aircraft  operated  by  the  NATO  nations  is  more  than  15  years  old.  As  engines  typically 
contribute  30%  of  the  life  cycle  cost  of  an  aircraft,  methods  aiming  at  an  extension  of  their  usable  life  attract  a 
widespread  attention.  There  have  been  various  conferences  and  working  groups  on  this  topic  initiated  by  the  RTO 
[RTOMP17,  RTOTR28].  All  topics  of  this  presentation  are  addressed  in  great  detail  in  unclassified  sources,  some  of 
which  are  put  together  in  the  references,  and  I  strongly  recommend  to  retrieve  at  least  some  of  the  available  material 
from  the  world  wide  web. 


Definition  of  fracture  critical  parts 

A  typical  definition  used  by  regulatory  agencies  in  civil  aviation  is  the  one  given  in  [JAR-E]:  “Where  the  failure 
analysis  shows  that  a  part  must  achieve  and  maintain  a  particularly  high  level  of  integrity  if  hazardous  effects  are  not 
to  occur  at  a  rate  in  excess  of  Extremely  Remote  then  such  a  part  shall  be  identified  as  a  Critical  Part”.  “Extremely 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects  ”,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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Fig.  2  :  Disk  driven  to  burst  during  overspeed  spin  test 


Remote”  probability  means  [JAR1]  “unlikely  to  occur  when  considering  the  total  operational  life  of  a  number  of 
aircraft  of  the  type  in  which  the  engine  is  installed,  but  nevertheless,  has  to  be  regarded  as  being  possible  (10'7  -  10'9per 
hour  of  flight)”.  In  the  glossary  of  [RTOTR28]  the  following  definition  is  given:  “A  part  which  will  physically  break, 
causing  catastrophic  damage,  after  experiencing  a  statistically  described  number  and  mix  of  missions.  Such  compo¬ 
nents  are  identified  at  design  time,  and  removed  from  service  before  failure  occurs.” 

The  engine  parts  most  likely  to  cause  severe  damage  to  the  aircraft  are  the  components  of  the  rotors,  the  most  massive 
ones  being  the  compressor  and  turbine  disks,  but  also  including  spacer  rings  or  rotating  air  seals,  that  may  sometimes 
also  penetrate  the  engine  casing  when  a  failure  occurs.  Engine  design  usually  is  required  to  ensure  containment  of 
broken  single  blades,  but  also  numerous  incidents  with  uncontained  fan  or  turbine  blades  have  been  reported  (e.g. 
[WB96,  JSSG2007]).  Although  the  focus  will  be  on  disks,  many  aspects  of  the  following  presentation  are  applicable 
to  blades  as  well.  Unfortunately,  actual  disk  failures  are  not  limited  to  experiments  performed  in  the  test  beds  of  engine 
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manufacturers  (see  example  in  Fig.  2),  but  they  also  happen  in  the  engines  of  commercial  passenger  jets  with  hundreds 
of  passengers  aboard.  Fig.  1  shows  a  fragment  of  the  fan  hub,  whose  failure  killed  two  passengers  aboard  a  MD-88 
in  Pensacola,  Florida,  in  1996  [NTSB98].  There  is  a  not  too  short  list  of  other  uncontained  disk  failures  in  the  engines 
of  civil  aircraft.  Many  of  them  occurred  during  the  run-up  to  takeoff  power  of  the  engines  on  ground,  thus  limiting 
somewhat  the  possible  consequences,  but  aircraft  have  been  destroyed  by  subsequent  fires,  as  in  the  Valuejet  accident 
in  1995  [NTSB96],  and  there  was  one  catastrophic  in-flight  failure  of  a  fan  hub,  claiming  the  lives  of  1 1 1  persons.  The 

direct  cost  of  that  crash  of  a  DC-10  in  Sioux  City  in  1989  totaled  over  300  million  US$  [Hall97]. 

A  recent  (June  2000)  uncontained  failure  of  the  HP  compressor  spool  of  a  GE  CF6-80,  that  happened  during  takeoff 
of  a  Boeing  767  in  Sao  Paulo,  Brazil,  led  to  the  recommendation  to  remove  certain  engines  from  service  to  perform 
inspections  to  detect  possible  cracking. 

The  military  flying  community  is  affected  by  failing  fracture  critical  parts  as  well.  The  following  description,  which 
gives  a  typical  example  for  the  consequences  of  an  uncontained  disk  failure  during  flight  is  cited  from  the  Flying 
Safety  Magazine  of  the  United  States  Air  Force  [Woo96]: 

“The  one  T-38  engine-related  Class  A  mishap  was  from  another  known  problem,  compressor  disk  corrosion.  A  crack 
propagated  from  a  corrosion  pit  in  the  No.  1  engine's  eighth  stage  compressor  disk.  When  the  disk  eventually  failed,  it 
penetrated  the  case,  severed  several  fuel  and  oil  lines,  and  caused  an  in-flight  fire.  The  shrapnel  and  fire  affected  the 
mishap  aircraft's  flight  controls,  forcing  the  crew  to  eject.  The  aircraft  crashed  in  an  apartment  complex,  killing  two 
and  injuring  several  other  civilians.  The  source  of  the  corrosion  is  still  unknown.  Oddly  enough,  no  other  users  of  the 
J85  engine  have  reported  corrosion,  including  the  Navy.  Regardless,  life  limit  reductions  are  being  implemented  to 
reduce  the  risk.  Corrosion-resistant  coatings  and  materials  are  also  being  explored.”  This  short  report  bears  nearly  all 
ingredients  of  what  may  happen  and  what  consequences  are  typically  deduced.  It  also  highlights  the  problem  of 
corrosion,  that  may  invalidate  the  results  of  sophisticated  life  extension  schemes. 

Disregarding  disk  failures  due  to  overspeed  which  might  occur  after  a  total  malfunction  of  the  control  or  fuel  system 
or  due  to  a  broken  shaft  in  the  engine,  disk  failures  usually  are  the  final  consequence  of  underestimated  and  undetected 
material  fatigue.  Even  in  initially  defect-free  parts  cracks  may  start  to  grow  at  highly  loaded  areas  of  the  rotor 
structure.  If  cracks  remain  undetected  and  operation  of  the  part  is  continued,  even  normal  cyclic  loading  will  eventu¬ 
ally  lead  to  an  unstable  crack  growth.  The  final  burst,  that  results  from  insufficient  residual  strength  of  the  heavily 
cracked  disk  under  high  load  will  produce  a  few  (typically  3  -  see  Fig.  2  and  [DK99])  high  energy  fragments,  that  will 
inevitably  penetrate  the  engine  casing,  with  a  high  chance  for  mission  abort,  air  vehicle  loss,  and  fatalities. 


Evolution  of  the  design  process 

The  tools  available  for  the  design  of  aero  engine  components  have  seen  a  dramatic  evolution  during  the  past  30  years. 
The  finite  element  (FE)  method  is  now  used  to  determine  (and  avoid)  in  advance  the  locations  of  high  stress  concentra¬ 
tions.  For  most  of  the  old  engines,  that  were  designed  before  1970,  such  computer  based  tools  were  only  available  to 
a  very  limited  extent.  At  that  time  the  design  of  rotors  was  largely  based  on  empirical  methods,  supported  by  experi¬ 
ments  (e.g.  photoelastic  strain  analysis).  The  limited  accuracy  of  the  available  computation  methods  for  temperatures 
and  stresses  had  to  be  compensated  by  the  selection  of  larger  safety  margins.  Only  since  the  middle  of  the  70's  FE 
programs  were  used  for  the  stress  calculation  of  rotor  components.  It  became  possible  to  design  disks  which  were 
stressed  more  evenly,  than  it  was  possible  with  the  classical  empirical  procedures.  Modern  design  methods  try  to 
minimize  weight  and  to  fully  exploit  the  available  strength  of  materials.  “Old”  rotor  components  often  have  only  a  few, 
clearly  identified  critical  life-limiting  areas,  whereas  a  larger  number  of  potentially  life-limiting  areas  has  to  be  taken 
into  consideration  for  newly  designed  “fully  stressed”  components. 

The  evolution  of  computational  methods  within  the  last  20  years  is  illustrated  in  Figs.  3  and  4.  Fig.  3  shows  a  finite 
element  mesh  that  was  used  for  the  axisymmetric  stress  analysis  of  the  IP  compressor  rotor  of  the  RBI 99  engine 
during  rotor  design  in  the  year  1979.  The  same  component  has  been  reassessed  in  1999  to  check  for  possible  life 
extensions.  The  refined  mesh  shown  in  Fig.  4  partially  removes  the  necessity  to  apply  empirical  stress  concentration 
factors  to  take  into  account  geometric  details  not  resolved  by  the  coarse  mesh.  In  1979  stress  engineers  had  to  wait 
days  for  the  computation  results.  With  modem  workstations  a  time  dependent  stress  analysis,  including  thermal 
stresses  and  a  life  assessment  for  the  whole  design  mission  can  be  run  within  a  few  minutes.  Fig.  5  shows  an  example 
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Fig.  3:  Compressor  rotor,  finite  el¬ 
ement  mesh  for  axi-symmetric 
stress  calculation  in  1979 
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Fig.  5:  Design  mission:  Results  of  finite  element  calculation  for  one  critical  area 


of  the  calculated  temperature  and  stress  at  a  critical  area,  together  with  the  spool  speed  for  the  design  mission.  Per 
definition,  the  largest  stress  cycle  of  this  mission  is  used  as  reference  for  LCF  life  counting  for  a  certain  critical  area. 
The  life  usage  of  this  cycle  is  set  to  a  value  of  1.0.  Life  releases  are  expressed  as  multiples  of  this  cycle. 

Safe  life  versus  damage  tolerance  design 

Currently  the  most  widely  used  lifing  policy  is  that  of  “Safe  Crack  Initiation  Life”.  This  is  the  classical  method  for 
lifing  in  the  low  cycle  fatigue  regime.  The  idea  of  the  concept  is  as  follows:  It  is  assumed,  that  a  new  part  is  free  of 
defects.  Under  operational  loading  a  defect  (e.g.  a  fatigue  crack)  is  generated.  When  the  defect  has  been  generated,  the 
part’s  life  is  expired.  The  life  end  criterion  is  a  certain  predefined  crack  depth  (e.g.  0.4  mm).  The  usable  life  is  defined 
as  the  life  of  the  weakest  individuum  of  a  population  of  parts.  As  a  result  of  experiments  and  experience,  a  lognormal 
distribution  of  lives  to  first  crack  (LTFC)  with  a  +3sigma  scatter  factor  of  6  is  assumed  for  conventional  disk  materi¬ 
als.  The  method  is  illustrated  in  Fig.  6,  showing  schematically  the  scatter  band  of  the  S/N  curves  of  a  large  number  of 
similar  parts.  Due  to  the  requirement  for  an  acceptably  low  statistical  probability  (e.g.  1/750)  for  the  existence  of  a 
crack  with  the  predefined  depth,  only  a  fixed  portion  of  the  average  life  is  available  for  operational  use.  There  is  no 
check  for  the  presence  of  the  life  limiting  crack,  when  parts  are  retired.  Details  of  the  method  are  discussed  in  [BLH98] . 
One  shortcoming  of  this  method  is  its  inability  to  predict  a  failure  margin.  The  method  tacitly  assumes,  that  a  0.4  mm 
crack  is  sufficiently  far  away  from  growing  in  an  uncontrolled  manner.  This  is  the  starting  point  for  the  so-called 
damage  tolerance  concepts.  It  is  assumed,  that  even  a  new  part  may  have  an  initial  defect,  which  behaves  like  a  crack 
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Fig.  6:  Distribution  of  cycles  to  crack  initiation 


of  a  certain  depth.  This  crack  propagates  under  operational  loading.  When  the  crack  enters  a  phase  of  unstable 
growth,  the  part’s  life  is  expired.  The  application  of  a  damage  tolerant  lifing  policy  requires  an  understanding  of  the 
crack  growth  process.  Experiments  and  fracture  mechanical  methods  have  to  be  combined  to  determine  the  number  of 
load  cycles  needed  to  propagate  cracks  at  the  critical  areas  from  the  assumed  initial  size  to  a  size  implying  the  risk  of 
disk  burst  (dysfunction).  There  are  various  criteria  for  dysfunction  of  a  part  [BB98]:  Unstable  crack  growth  under 
basic  operational  loading,  onset  of  continuous  crack  propagation  due  to  superimposed  vibratory  stresses,  loss  of 
overspeed  capability  (insufficient  residual  strength),  unacceptable  out-of-balance  conditions. 


Fig.  7:  Life  extension  into  the  crack  propagation  regime 
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The  information  about  crack  growth  can  be  used  in  different  manners.  The  first  method  is  an  extension  of  the  “Safe 
Initiation  Life”  concept,  called  the  “Safe  Crack  Propagation  Life”.  This  method  is  described  in  [BB98].  The  “Initia¬ 
tion  Life”  criterion  (e.g.  occurrence  of  a  0.4  mm  crack)  is  replaced  by  the  “2/3  Dysfunction  Life”  criterion.  For  crack 
tolerant  components  having  a  long  crack  propagation  life,  significant  life  extensions  compared  to  “Initiation  Life”  are 
possible.  On  the  other  hand  the  application  of  the  “2/3  dysfunction  life  criterion”  to  components  with  low  damage 
tolerance  may  even  require  a  reduction  of  the  life  figures  derived  from  the  “Initiation  Life”  criterion.  This  is  necessary 
to  ensure  a  consistent  safety  margin. 

All  of  the  methods  described  so  far  do  not  exploit  information  from  inspections.  Parts  are  scrapped  when  they  have 
reached  their  released  lives  irrespective  of  the  actual  presence  of  cracks.  If  reliable  nondestructive  inspection  (NDI) 
methods  are  available,  that  are  able  to  guarantee  defect  sizes  below  prescribed  limits,  then  the  method  illustrated  in 
Fig.  7  is  applicable.  A  part  can  be  returned  into  service,  if  it  is  found  defect-free  or  the  defects  are  so  small,  that  the 
expected  crack  propagation  period  is  longer  than  the  planned  inspection  interval. 

Lifing  policies 

The  lifing  policy  that  will  be  applied  to  a  new  engine  is  usually  discussed  and  agreed  by  the  contractors.  As  already 
mentioned,  the  most  commonly  used  lifing  policy  in  Europe  is  the  "Safe  Life"  approach.  In  this  method  only  a  chosen 
percentage  (e.g.  50%)  of  the  calculated  expected  life  is  released  at  entry  into  service  of  a  new  engine.  This  applies  also 
to  the  introduction  of  engine  or  component  modifications,  that  are  judged  to  significantly  influence  the  life  of  the 
affected  components.  Evidence  has  to  be  provided  by  performing  spin  pit  tests  with  full  scale  components,  by  which 
the  component  is  subjected  to  a  series  of  cyclic  load  changes.  The  load  levels  are  chosen  to  exceed  the  expected 
operational  loads  by  a  chosen,  usually  moderate  percentage.  This  overload  provides  some  safety  margin  against 
uncertainties  in  the  stress  calculations  and  it  also  serves  to  shorten  test  times,  that  are  a  substantial  cost  factor  during 
component  qualification.  Spin  tests  are  continued  until  cracks  start  to  grow  at  critical  areas  of  the  disks. 

If  the  need  arises,  the  test  may  also  be  continued  into  the  crack  propagation  regime,  however  requiring  some  exten¬ 
sions  of  the  experimental  planning  and  evaluation  (e.g.  application  of  marker  loads,  determination  of  crack  geometry). 
This  is  necessary  to  produce  the  data  required  for  a  prospective  inclusion  of  the  parts  crack  growth  potential  into  an 
extended  life  release. 

Dependent  on  the  number  of  tested  disks  and  on  the  achieved  number  of  test  cycles,  at  first  only  a  certain  percentage 
of  the  life  demonstrated  in  the  spin  test  is  released.  Safety  factors  have  to  be  included  taking  into  account  the  very 
small  (typically  not  more  than  2  or  3)  sample  size.  Spin  tests  are  continued  in  parallel  to  the  operation  of  the  engines 
in  the  users'  fleets.  Based  on  an  extrapolation  of  usage  data,  that  may  either  consist  of  cycles  accumulated  by  engine 
monitoring  systems  or  simply  based  on  the  number  of  flights  or  accumulated  flight  time,  required  schedules  for  life 
releases  are  determined.  When  the  first  components  have  reached  the  life  released  so  far,  at  least  one  of  those  compo¬ 
nents  is  removed  from  service  and  it  is  then  tested  for  remaining  life  in  a  cyclic  spin  test.  The  new  results  are  used  to 
release  a  further  portion  of  the  life.  This  process  is  continued,  until  100%  of  life  can  be  released. 

The  formal  life  release  usually  is  authorized  by  a  regulatory  agency  based  on  available  evidence.  In  contrast  to 
commercial  aviation,  where  international  standards  (e.g.  [JAR-E])  are  applied,  it  is  quite  common  in  military  aviation, 
that  different  users  of  the  same  engine  types  use  different  methods  of  life  releases  or  even  different  lifing  policies. 
Lifing  philosophies  may  be  different  within  one  country:  In  the  USA,  the  US  Air  Force  practices  the  damage  tolerance 
philosophy,  whereas  the  US  Navy  practices  the  safe  life  approach. 

There  is  a  number  of  reasons  for  an  enhancement  or  modification  of  the  existing  methods.  Possible  extension  are  the 
inclusion  of  test  results  from  other  sources  than  spin-pit  tests,  e.g.  specimen  tests,  an  improved  statistical  approach 
[BLH98]  to  take  into  account  so-called  non-finite  test  results  (i.e.  no  crack  has  occurred  at  some  intermediate  stage  of 
the  cyclic  spin  pit  tests). 

Experience  from  a  number  of  projects  shows,  that  it  is  not  always  possible  to  take  into  account  all  life  limiting  areas 
in  the  initial  assessment  of  a  new  or  redesigned  component.  If  cracks  occur  at  unexpected  locations  (either  during  the 
spin-pit  tests  or  during  operational  use),  those  areas  have  to  be  introduced  into  the  defined  lifing  process  or  they  have 
to  be  treated  by  a  different  method,  e.g.  scheduled  inspections. 
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Fig.  8:  Spool  speed  of  real  mission 
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Fig.  9:  Distribution  of  single  flight  life  usage 
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Fig.  10:  Assumed  shift  of  life  consumption  distribution  for  aging  engines 


For  the  RB 199  engine  the  “Safe  Initiation  Life”  policy  was  initially  chosen.  During  the  first  years  of  operation,  cracks 
were  found  at  some  unexpected  areas  of  the  rotors.  If  treated  with  the  original  method,  the  affected  components  would 
have  to  be  retired  long  before  reaching  their  expected  life  limits.  To  recover  some  of  the  life  potential,  the  damage 
tolerance  at  the  newly  detected  critical  areas  was  assessed.  The  application  of  the  “2/3  dysfunction  life  criterion”  may 
restore  the  originally  expected  usage  times,  if  the  crack  propagation  life  extends  over  a  sufficiently  large  number  of 
load  cycles.  The  application  of  the  “Safe  Crack  Propagation  Life”  to  the  IP  compressor  and  the  IP  turbine  of  the 
RB199  is  described  in  [BB98]. 

If  cracks  occur  at  locations  with  lacking  damage  tolerance,  it  is  also  possible  to  integrate  inspections  into  the  lifing 
process.  In  some  circumstances  inspections  may  also  be  required,  if  only  a  limited  number  of  parts  behaves  different 
from  the  rest  of  the  population.  If  deviations  in  the  production  process  have  occurred,  whose  influence  on  life  was  not 
known  at  production  time,  the  information  required  to  decide  on  possible  life  reductions  may  only  accessible  by  an 
inspection. 


Adaptation  of  the  lifing  process  to  in-service  experience 

The  first  experience  in  nearly  every  military  engine  project  is  the  realization,  that  there  exist  non-negligible  differences 
between  the  design  missions  and  the  actual  usage.  Although  design  missions  have  become  more  realistic  for  newer 
projects  (see  e.g.  [JSSG2007]),  it  is  nearly  impossible  to  cast  usage  patterns  similar  to  those  of  Fig.  8  into  manageable 
specifications.  Data  recordings  taken  during  the  first  time  of  in  service  usage  may  be  used  to  determine  the  scatter  of 
life  usage  caused  by  different  missions.  An  example  (Fig. 9)  from  [BP97]  shows,  that  the  assumption  of  a  life  usage 
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proportional  to  flight  time  does  not  hold  for  single  flights.  A  better  approximation  is  to  determine  probability  distribu¬ 
tions  describing  the  life  usage  per  flight  (Fig.  10).  Due  to  thrust  requirements  for  take  off,  life  usage  per  flight  is 
always  greater  than  some  minimum  value  for  most  of  the  critical  areas. 

The  requirement  for  maintaining  some  prescribed  thrust  level  is  also  the  reason,  that  we  have  to  assume  some  shift  of 
the  life  usage  distributions  for  aging  or  deteriorated  engines  (Fig.  10).  If  the  control  system  tries  to  maintain  the  thrust 
level  by  increasing  engine  temperature  and  speed,  usage  will  be  more  severe  due  to  increased  thermal  and  mechanical 
stresses  and  also  due  to  lower  life  potential  of  the  materials  at  higher  temperatures,  even  if  no  change  in  mission  types 
occurs. 

There  are  numerous  parameters,  by  which  the  use  of  a  component  can  be  described.  Flight  time,  engine  running  time, 
number  of  flights,  number  of  engine  runs,  engine  running  time  above  certain  spool  speeds,  time  at  certain  tempera¬ 
tures.  More  appropriate  for  a  description  of  the  usually  life  limiting  processes  are  parameters  approximating  the  cyclic 
properties  of  engine  operation.  The  best  known  method  is  the  counting  of  so-called  TACs  (total  accumulated  cycles) 
mainly  in  use  at  the  USAF. 

Because  of  the  somewhat  arbitrary  definition  of  the  power  ratings  this  procedure  can  be  refined  by  admitting  arbitrary 
spool  speed  values  in  the  assessment  of  the  contribution  of  a  spool  speed  cycle.  The  method  outlined  below  is  an 
extension  of  counting  TACs.  If  it  is  implemented  in  an  on-board  monitoring  system  or  in  a  ground-based  system  for  the 
assessment  of  recorded  engine  data,  the  results  are  directly  comparable  with  specification  values  using  TACs  as  a 
measure  for  cyclic  engine  or  component  usage.  The  method  for  "continuous  TAC  cycle  counting"  consists  of  the 
following  steps: 

1)  Calculation  of  non-dimensional  spool  speeds  N  =  Nphys/Nre^  where  Nref  is  the  100%  spool  speed,  equivalent  to  the 
“intermediate  rated  power”  (IRP)  used  in  the  definition  of  the  “Type  I,  III,  IV”  cycles  [JSSG2007]. 

2)  (Nmin,  Nmax)  cycle  extraction  for  the  selected  spool  speed  signal  with  a  rainflow  method,  using  one  of  the  available 
very  efficient  methods  for  real-time  cycle  extraction.  The  rainflow  method  replaces  the  simple  gate  based  counting 
used  in  the  original  TAC  definition. 

3)  Computation  of  hypothetical  stresses  for  the  extreme  values  of  the  cycle,  i.e.  S  .  =  N  . 2,  S  =  N  2. 

4)  Assumption  of  a  maximum  (e.g.  burst)  speed  NUm  and  a  corresponding  hypothetical  stress  SUm  -  NUm2  and  of  a 
hypothetical  "endurance  limit"  Scut  -  SUm  •  FCUT ,  where  FCUT  is  a  chosen  percentage  of  SUm.  Cycles  (0,Smax)  with 
Smax  <  S cut  contribute  zero  usage.  The  endurance  limit  is  defined  as  the  maximum  applied  cyclic  stress  amplitude  for 
an  ‘infinite’  fatigue  life.  Generally  ‘infinite’  life  means  more  than  10  million  cycles  to  failure. 

5)  Conversion  of  the  (S  . ,  S  )  cycle  into  an  equivalent  (0,S  )  cycle  with  the  Goodman  formula 
S  =S-(S  -S  .  )/( Sr  -S  .  ) 

eq  lim  '  max  min  '  '  lim  min  ' 

6)  Calculation  of  an  auxiliary  stress  5  =S  /  S  -FCUT 

7)  Calculation  of  the  hypothetical  damage  of  the  found  spool  speed  cycle  D  =  ( SauJ  ( 1  /  Scut  -  FCUT )  )ESN ,  where 
ESN  is  an  assumed  slope  of  a  hypothetical  S/N  curve. 

The  parameters  in  the  formulas  above  can  be  chosen  to  closely  match  the  definition  of  TACs  provided  in  [JSSG2007] 
or  in  the  appendix  of  [RTOTR28]:  TAC  =  LCF  +  FTC/4  +  C/C/40, 

where  LCF  =  "Engine  Start  to  IRP  to  Engine  Stop  Excursion",  FTC  =  "Idle  to  IRP  to  Idle  Excursion", 

C/C  =  "Cruise  to  IRP  to  Cruise  Excursion". 

The  following  parameter  settings  match  the  TAC  definition  assuming  the  spool  speeds  of  the  HP  spool  of  the  RB 199 
engine  (Idle=65%,  Cruise  (assumed)=81%):  Af.m=120%,  FCUT-  0.55,  ESN-  3.5.  With  this  definition  a  (65%, 100%) 
cycle  will  produce  a  usage  of  0.25,  a  (81%, 100%)  cycle  will  give  usage  0.025. 

For  engines  with  2  or  three  spools,  it  is  advisable  to  use  separate  definitions  for  the  different  spool  speeds,  since  the 
percentage  values  of  idle  and  cruise  will  be  significantly  different  for  HP  and  LP  spools.  The  definition  NUm=  130%, 
FCUT=0A,  ESN=2.0  is  a  choice  giving  higher  weight  to  “sub-cycles”.  The  results  for  the  two  selected  parameter 
settings  are  shown  in  Fig.  11  for  ( 0,Nmax )  cycles  and  in  Figs.  12  and  13  for  arbitrary  cycles. 

A  cycle  counting  system  using  the  above  mentioned  or  similar  parameters  would  produce  consistent  usage  figures, 
that  allow  the  recognition  of  changing  usage  due  to  new  tactics,  operational  procedures,  pilot  training  etc.  However,  it 
must  be  emphasized  that  TAC  cycle  counting  provides  only  a  gross  measure  of  usage  and  cannot  fully  replace  moni¬ 
toring  functions  specifically  tailored  to  the  thermomechanical  behaviour  of  the  critical  parts. 
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Fig.  11 :  TAC  equivalent  of  arbitrary  0-max  spool  speed  cycle 

The  impact  of  recording  and  monitoring  systems 

Without  information  on  the  usage  of  an  engine  in  service,  very  conservative  assumptions  have  to  be  made  with  regard 
to  the  life  usage  of  critical  parts.  If  a  new  or  modified  engine  is  introduced  into  service,  a  commonly  used  method  is 
either  to  assume  a  certain  mission  mix  composed  of  the  specified  design  missions,  or,  somewhat  better,  to  use  record¬ 
ings  from  flight  tests  to  substitute  the  missing  information  on  usage  in  service.  From  those  assumed  or  recorded  data, 
the  life  consumption  at  all  critical  areas  of  the  engine  rotors  has  to  be  computed.  However  this  requires  mathematical 
models  of  the  thermal  and  mechanical  behaviour  of  the  rotors  suitable  to  calculate  the  life  consumption  for  arbitrary 
input  data.  Such  simplified  models  have  to  be  derived  from  the  complex  finite  element  models  used  by  the  manufac¬ 
turer  during  component  design. 

If  no  life  usage  monitoring  system  is  used,  the  common  practice  is  the  assignment  of  conservative  life  usage  figures  to 
all  critical  areas.  Each  area  then  has  a  so-called  B-factor  (average  cyclic  exchange  rate)  describing  the  life  usage  per 
flight  hour  or  some  other  easily  available  usage  figure  (e.g.  engine  running  time,  number  of  flights).  The  fatigue  life 
consumption  at  a  critical  area  is  then  computed  by  a  multiplication  of  the  B-factor  with  accumulated  flight  time.  The 
accumulated  cycles  have  to  be  compared  with  the  released  lives.  A  part  is  removed  from  service,  if  either  the  life  limit 
is  reached  or  if  the  part  is  accessible  during  maintenance  and  the  low  remaining  life  makes  the  reuse  of  the  part 
uneconomical. 

A  more  accurate  determination  of  cyclic  exchange  rates  can  only  be  obtained  from  a  sufficiently  large  number  of  flight 
and  engine  data  recordings,  with  some  side  conditions  concerning  data  quality,  availability  of  configuration  informa¬ 
tion  and  statistical  significance  (e.g.  data  from  different  engines,  air  bases,  mission  types  etc.).  With  those  data,  it  is 
possible  to  derive  statistically  meaningful  data  on  the  usage  scatter  within  the  fleet  for  each  critical  area  of  all  critical 
parts. 


Risk  mitigation  techniques 

The  most  popular  and  probably  most  costly  risk  mitigation  technique  is  a  regular  inspection  of  all  candidate  locations 
for  fatigue  cracks,  using  NDI  methods.  This  is  currently  performed  in  the  commercial  aviation  world  for  certain 
components  of  older  engines  known  to  be  at  higher  risk  level  due  to  deviations  either  in  the  material  properties,  in  the 


Fig  14:  Measured  crack  growth  history  for  rim  area 


critical  area 


manufacturing  process  or  in  the  application  of  certain  repair  methods  causing  a  reduction  of  the  life  potential.  If 
shortages  of  parts  occur,  it  is  sometimes  inevitable  to  “Inspect-In-Safety”  as  a  risk  management  tool.  Knowledge 
gained  by  recording  or  monitoring  can  be  used  to  mitigate  the  risks.  Naturally  even  the  most  sophisticated  monitoring 
system  or  crack  propagation  prediction  cannot  really  recover  life.  However  a  risk  evaluation  is  simplified,  if  sound 
statistical  information  on  usage  spectra  is  available. 

It  may  sound  surprising,  but  sometimes  it  is  easier  to  make  statistic  statements  about  the  use  of  engines  in  a  fleet,  if  the 
missions  are  randomly  assigned  to  the  available  aircraft,  as  if  the  missions  are  assigned  aimed  at  individual  aircraft. 
Sometimes  the  allocation  of  certain  mission  types  to  individual  aircraft  cannot  be  prevented,  if  e.g.  these  aircraft  are 
equipped  with  special  electronics,  armament  etc.  On  a  long-term  basis  it  should  be  tried  however  not  to  always  equip 
these  aircraft  with  the  same  engines  since  the  underlying  assumptions  of  a  risk  evaluation  otherwise  possibly  can  be 


Accumulated  LCF  Damage 
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Fig.  16:  Locally  refined  FE  mesh  for  crack  growth  calculation 


0  Accumulated  Flight  Time 


Fig.  17:  Accumulated  LCF  damage  for  turbine,  determined  by  fleet-wide  monitoring 
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hurt,  e.g.  if  a  strongly  damaging  mission  type  for  the  engine  is  continuously  flown.  Plans  for  parts  replacement  or 
inspection  schedules  assuming  average  usage  (e.g.  relying  on  usage  distributions  like  those  shown  in  Fig.  10)  may  then 
considerably  underestimate  the  real  risk. 


Application  of  fracture  mechanical  methods  to  determine  safe  inspection 

intervals 

Cited  from  [SukOO]:  “The  relevance  and  importance  of  the  computation  of  fracture  parameters  and  the  simulation  of 
three-dimensional  crack  growth  stems  from  the  widespread  use  of  numerical  fracture  mechanics  in  fatigue  life  predic¬ 
tions  of  safety  critical  components  such  as  aircraft  fuselages,  pressure  vessels  etc.  Fatigue  failure  usually  occurs  due 
to  the  initiation  and  propagation  of  surface  or  near- surface  cracks,  which  are  often  assumed  to  be  elliptical  or  semi¬ 
elliptical  for  numerical  modelling.  Closed-form  solutions  for  the  stress  intensity  factors  (SIFs)  are  available  for  simple 
crack  geometries  in  three  dimensions;  however,  for  arbitrary- shaped  cracks  in  finite  specimens,  numerical  methods 
are  the  only  recourse  to  modelling  three-dimensional  fatigue  crack  growth.” 

Although  final  knowledge  can  only  be  obtained  by  performing  expensive  tests,  the  application  of  finite  element  meth¬ 
ods  to  the  cracking  of  components  is  now  within  reach.  To  determine  how  a  crack  will  propagate  from  an  initial  flaw 
at  a  critical  area  of  the  component,  the  traditional  FE  methods  have  to  be  enhanced  by  re-meshing  techniques,  which 
adapt  the  mesh  to  the  crack  geometry  [Dho98].  Such  methods  have  already  been  used  to  predict  the  crack  growth  for 
components,  whose  life  would  have  been  expired,  if  the  classical  safe  life  criteria  were  applied.  One  such  component 
was  the  IP  turbine  disk  of  the  RB 199  engine,  for  which  cracks  were  found  in  the  rim  area.  Fig.  14  shows  the  results  of 
a  cyclic  spin-pit  test,  including  the  application  of  experimental  techniques  (marker  loads)  for  a  visualization  of  the 
crack  front.  To  understand  the  crack  propagation  process  and  to  obtain  verified  data  that  can  be  used  for  a  life 
extension  into  the  crack  propagation  regime,  the  crack  growth  process  (Fig.  15)  was  studied  in  a  3-dimensional  FE 
calculation.  Fig.  16  shows  details  of  the  FE  mesh  used  to  calculate  the  crack  growth  at  the  bottom  of  the  firtree  area 
of  the  IP  turbine  disk.  The  method  is  described  in  more  detail  in  [BK99].  The  results  of  the  simulation  were  compared 
with  the  experimental  data.  A  simplified  model  was  developed  and  implemented  in  the  OLMOS  system,  thus  recover¬ 
ing  a  considerable  amount  of  usable  life. 

Recently  also  methods  have  become  available,  that  try  to  avoid  the  explicit  meshing  of  the  crack  surface  by  adding 
“enrichment  functions”  to  the  FE  approximation  in  the  vicinity  of  the  crack- tip  [SukOO].  The  fnite  element  calcula¬ 
tions  have  to  rely  on  suitable  material  data,  e.g.  crack-growth-rate  curves  as  a  function  of  stress  intensity  factor 
ranges.  There  is  an  urgent  need  for  an  extension  of  the  comparatively  small  database  of  available  crack  growth  data 
for  engine  materials,  which  is  still  a  field  of  intensive  worldwide  research. 

Experience  from  operative  engine  monitoring  systems 

Starting  around  1980,  various  monitoring  systems  have  been  developed.  One  of  the  most  comprehensive  systems  is 
OLMOS  (On-boardTdfe  usage  Monitoring  System),  which  is  now  in  use  for  more  than  13  years.  This  system  moni¬ 
tors  the  fatigue  life  usage  of  the  engines,  the  airframe  structure  and  performs  a  variety  of  other  monitoring  tasks. 
There  have  been  several  publications  on  this  system,  its  architecture  and  its  results,  e.g.  [BP97].  One  of  the  most 
important  findings  was,  that  such  a  system  is  not  a  static  one.  The  method  for  tracking  the  life  of  critical  parts  is  not 
necessarily  to  be  held  constant  during  the  whole  life  of  an  engine.  There  exist  a  lot  of  external  and  internal  factors 
requiring  a  continuous  adaptation  of  the  life  usage  monitoring  functions  [PR95].  The  OLMOS  is  installed  in  all 
Tornado  aircraft  of  the  German  air  force.  Fig.  17  shows  an  example  of  the  computed  life  usage  for  one  critical  area 
on  a  turbine  disk,  including  all  flying  engines  an  also  spare  parts.  The  two  solid  lines  show  the  results  of  a  statistical 
fleet  simulation  performed  for  the  engine  variant  “1”,  using  distribution  functions  similar  to  those  shown  in  Fig.  10, 
that  have  been  derived  from  recorded  flight  data.  As  the  turbine  disk  under  consideration  is  exchangeable  between  the 
engine  variants,  the  3  distinct  clouds  will  continue  to  diffuse,  partially  also  caused  by  deliberate  decisions  of  the  fleet 
managers  to  change  disks  between  the  engine  variants. 
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Fig.  18:  Overview  of  life  usage  monitoring 
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Requirements  for  engine  monitoring  systems 

If  a  new  system  is  defined,  there  is  a  wide  range  of  possible  architectures.  Requirements  for  an  engine  monitoring 
system  have  to  be  a  balance  of  the  selected  benefits  and  the  available  capabilities.  [ARP1587]  provides  an  extensive 
list  of  possible  design  options.  Improved  life  management  would  need  reliable  usage  monitoring  systems  to  have 
realistic  stress  and  temperature  cycles  [LI98].  Fig.  18  gives  an  overview  of  the  data  acquisition  and  calculation 
procedure  to  be  implemented  in  an  engine  life  usage  monitoring  system.  A  comprehensive  treatment  of  all  aspects  of 
engine  life  consumption  monitoring  is  given  in  [RTOTR28] .  The  calculation  of  the  usage  parameters  need  not  neces¬ 
sarily  be  performed  on-board.  It  is  also  possible  to  use  recorded  flight  and  engine  data,  that  are  collected  on-board  and 
then  downloaded  by  some  suitable  means  (ranging  from  magnetic  tapes  to  satellite  communication  links),  and  do  all 
the  processing  in  a  ground  station  or  even  at  a  centralized  facility  or  at  industry.  We  are  currently  investigating 
systems,  that  use  highly  compressed  data  storage  in  the  aircraft,  to  remove  the  need  for  frequent  downloads.  Monitor¬ 
ing  systems  based  on  data  recording  have  a  potential  to  remove  some  of  the  problems  found  in  the  existing  on-board 
systems,  e.g.  their  inability  to  quickly  react  on  changes  in  critical  areas  or  the  high  cost  of  updates  after  engine 
modifications. 


Recommendations  for  fleet  usage  management 

Although  carefully  planned  inspections  and  the  evaluation  of  usage  data  are  the  basic  building  blocks  for  a  minimum 
risk  extension  of  aircraft  and  engine  life,  the  allocation  of  material  can  significantly  contribute  to  an  acceptable 
availability  of  an  aircraft  fleet.  A  fleet  manager  will  usually  try  to  avoid  that  engines  have  to  be  removed  from  an 
aircraft  only  because  a  single  fracture  critical  part  has  reached  its  life  limit.  He  will  also  try  to  avoid  foreseeable  engine 
changes  due  to  parts  becoming  life-ex,  if  the  aircraft  is  at  some  remote  base  without  proper  maintenance  support.  A 
centralized  logistical  database  containing  the  life  usage  data  of  all  flying  and  spare  parts  can  be  used  to  direct  the 
necessary  parts  to  the  right  locations  at  the  right  time. 

For  components  with  a  high  variability  in  flight  to  flight  usage  there  will  also  be  a  larger  scatter  in  accumulated  life 
usage  for  a  given  range  of  engine  running  or  flight  time.  Systematic  differences  (e.g.  those  resulting  from  different 
thermomechanical  environments  if  the  parts  are  used  in  engines  of  different  build  standards)  can  lead  to  distinct 
clusters  of  parts  in  the  cycles  versus  hours  plot.  Fig.  17  shows  an  example  from  the  GAF  database  for  one  critical  area 
on  a  turbine  disk  of  the  RBI 99  engine.  This  area  experiences  systematically  different  life  usage  dependant  on  the 
engine  variant.  The  reason  is  the  introduction  of  engine  modifications  that  had  an  influence  on  the  spool  speed  rela¬ 
tions  between  the  HP,  IP  and  LP  spools.  The  engine  standard  present  at  entry  into  service  corresponds  with  variant  1. 
Some  years  later  modifications  have  been  introduced,  that  led  to  somewhat  higher  LP  spool  speeds.  This  standard, 
indicated  by  “variant  2”  is  currently  the  most  frequent  one.  The  data  marked  with  "engine  variant  3"  are  from  rede¬ 
signed  engines  with  a  new  larger  fan  with  a  significantly  reduced  rotational  speed  of  the  LP  spool.  Those  engines  were 
introduced  7  years  after  delivery  of  the  first  engine  variant.  Life  usage  distributions  similar  to  the  one  of  Fig.  17  have 
some  advantages  for  fleet  life  management.  The  large  differences  can  be  taken  into  account  in  a  parts  allocation 
strategy,  which  exploits  the  life  potential  by  clever  changes  between  different  engine  variants. 

If  certain  critical  parts  need  frequent  inspections  due  to  deficiencies  in  their  design,  manufacture,  material,  corrosion 
resistance  or  fatigue  life,  those  inspections  may  become  a  decisive  cost  factor.  In  [WB97]  an  example  is  given  for  the 
F100-PW-100  engine.  For  this  engine  failures  of  the  third-stage  fan  disk  lug  resulted  in  uncontained  fan  blade  libera¬ 
tions.  The  frequent  ultrasonic  inspections  of  the  disk  lug,  that  had  to  be  performed  to  keep  the  risk  acceptable  were 
reported  to  have  become  the  No.l  maintenance  man-hour  driver  in  the  F100.  The  solution  was  to  incorporate  new 
zero-time  disks  to  gain  some  inspection-free  time  until  redesigned  disks  and  blades  became  available. 

The  management  of  parts  has  to  take  into  account  long-term  plans  for  fleet  size.  Many  air  forces  are  now  considering 
to  reduce  fleet  sizes  far  below  the  figures  planned  and  acquired  at  the  end  of  the  cold  war  era.  A  balance  has  to  be 
found  between  affordable  peace  time  operation  and  high  availability  during  a  potential  crisis.  It  is  not  always  economi¬ 
cal  to  use  the  full  life  potential  of  all  parts.  It  is  noted  in  [TH98]  that  it  may  be  sometimes  advantageous  to  scrap  parts 
a  considerable  time  before  their  life  is  expired,  if  the  cost  of  engine  disassembly,  downtime  etc.  is  considered.  This  will 
also  reduce  cost  due  to  handling,  depot  operation  and  administration. 
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SUMMARY 

The  life  of  a  weapon  system  is  influenced  to  a  high  degree  by  the  structural  integrity  of  the  airframe.  Numerous  programs  to 
ensure  this  have  been  established  within  NATO's  Air  Forces.  Structural  loads,  leading  to  fatigue  as  well  as  corrosion, 
depending  on  the  usage  environment,  are  the  major  reason  for  degradation  of  structures.  The  many  different  classes  of  loads, 
the  generation  of  loading  conditions  during  the  design  phase,  as  defined  in  the  weapons  systems  specification,  consideration 
of  static  and  fatigue  loads  for  structural  lay-out  and  validation  concepts  are  presented. 

The  procedure  of  converting  overall  aircraft  loads  (“external  loads”)  into  individual  component  loads  is  shown  in  principal . 

0.  BACKGROUND 

The  effectiveness  of  military  force  depends  in  part  on  the  operational  readiness  of  aircraft  which  itself  is  largely  dependent 
on  the  condition  of  the  airframe  structure.  This  condition  again  is  affected  by  a  number  of  factors  among  those  the  physical 
loads  in  various  forms  together  with  the  used  life  of  the  airframe  are  important.  With  increased  and  extented  usage  of 
airframes  in  all  airforce  inventories  and  the  requirement  for  various  role  changes  the  subject  of  airframe  loads  assessment,  - 
qualification  and  aircraft  loads-monitoring  becomes  more  important,  not  only  for  flight  safety  but  also  and  with  an 
increasing  tendency  for  economic  reasons. 

A  general  understanding  of  the  various  types  of  airframe  loads,  their  generation  and  application  during  the  design  process, 
the  transfer  processes  from  "external  loads"  into  "structural  loads",  loads  qualification  during  ground  and  flight  testing  is 
therefore  of  equal  importance  to  the  process  of  usage  monitoring  and  derivation  of  usage  factors  from  the  different  fatigue 
tests  or  the  set-up  of  structural  inspection  programs. 

When  life  of  aircrafts  are  discussed,  often  the  flight  hours  or  number  of  flights  are  still  considered  the  governing  factor, 
sometimes  adapted  with  factors  on  "damage  hours"  or  "usage",  while  from  a  structural  engineering  viewpoint  the 
operational  stress  spectrum  and  therefore  the  life  on  the  different  aircraft  components  are  not  only  a  matter  of  flight  hours 
and  spectrum  ratio  but  also  driven  by  modification  status,  structural  weight  status  and  role  equipment. 

This  paper  describes  loads-  analysis  and  verification  activities  during  the  major  phases  of  the  life  of  an 

airframe,  where  structural  loads  and  their  influences  on  the  airframe  condition  are  vital  to  the  structural  integrity  and  the 

economic  usage  of  the  weapon  system: 

*  The  structural  loads  during  design  and  Qualification  of  A/C  structures 

*  Loads  monitoring  during  usage 

*  Impacts  due  to  aircraft  modification  and  role  changes. 

Trends  with  respect  to  the  increased  usage  of  theoretical  modelling  are  also  discussed. 

1.  STRUCTURAL  LOADS  DURING  THE  DESIGN  AND  QUALIFICATION  OF  AIRCRAFT  STRUCTURES 

Loads  are  accompanying  an  aircraft’s  life  from  “the  cradle  to  the  grave”.  Although  the  overall  type  and  magnitude  of  major 
load  sets  remain  the  same,  there  is  no  “fixed”  loadset  that  is  be  applied  to  one  aircraft  model  throughout  the  life  and  often 
identical  airframes  serving  different  roles  within  a  fleet  over  time  will  be  subjected  to  very  different  loads. 

To  include  as  much  as  possible  (or  specified)  of  these  loading  scenarios  in  the  early  process  of  designing  a  new  type  of 
aircraft  is  the  responsibility  of  the  loads  engineering  department,  while  ensuring  that  these  loads  can  be  safely  endured 
throughout  the  specified  life  is  the  task  of  the  design  and  stress  engineers.  “New”  loadsets,  developed  later  during  usage  of 
the  aircraft  are  common  tasks  and  handled  similar  as  the  “initial  design  loads”  by  the  design  authority  with  the  constriction, 
that  now  the  airframe  is  already  build  and  deployed  and  the  focus  is  on  minimising  changes  though  structural  modifications 
to  qualify  the  structure  for  its  new  environment  either  through  analysis  and  /  or  test. 

In  short,  every  major  change  in  the  aircraft’s  role,  payloads  or  usage  in  principle  influences  the  loads  acting  on  the  airframe 
or  at  least  some  components.  Fig.  1-1  gives  an  idea  how  loads  are  initially  generated  and  how  they  are  used  throughout  the 
design-,  qualification-  and  usage  process. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 


9-2 


Fig.  1-1  Loads  Main  Tasks 


1.1  Loads  and  Fatigue 

The  determination  of  loads  together  with  the  qualification  for  static  strength  and  fatigue  by  calculation  and  test  for  all 
important  structural  components  is  a  main  prerequisite  for  successful  design  and  safe  operation  of  any  aircraft. 

Whereas  for  transport  aircraft  with  their  rather  limited  range  of  operational  manoeuvres  and  high  number  of  flight  hours  / 
cycles  fatigue  is  the  main  design  driver  for  the  airframe,  fighter  aircraft  are  predominantly  designed  to  (static)  limit  load 
cases  for  the  “comers”  of  the  envisaged  flight  envelope,  which  in  general  cover  a  lot  of  strength  required  for  fatigue  of  their 
comparatively  short  life. 

But  this  is  only  tme  as  long  as  fighter  life  does  not  exceed  the  originally  planned  lifetime  and  the  roles,  missions  etc.  are 
compatible  with  the  design  criteria  at  the  beginning. 

Aging  aircraft  in  both  cases  does  not  only  mean  that  an  aircraft  is  getting  older  in  terms  of  flight  hours  and  flight  cycles,  it 
also  means  that  some  of  the  reference  data  for  the  basic  design  criteria  have  changed  during  time,  i.e.: 

-  airframe  and  equipment  mass  growth 

-  enhancement  of  systems  performance,  especially  engine  thrust 

-  new  configurations  (stores) 

-  update  of  flight  control  systems  (FCS)  (electronically  or  hardware  changes  like  added  slats  or  enlarged  ailerons) 

-  mission  profiles  and  additional/changed  roles 

-  actual  usage  spectmm 

Most  of  these  changes  have  an  immediate  impact  on  aircraft  load  scenarios,  others  will  not  change  load  levels  but  may 
change  underlying  statistic,  e.g.  fatigue  spectra.  Assessment  of  external  loads  is  therefore  a  basic  task  throughout  the  life  of  a 
fleet. 

Admittedly  in  many  cases  there  is  no  simple  one  to  one  relationship  between  “external”  loads  and  local  internal  stresses, 
which  after  all  are  the  basis  for  the  assessment  of  “life  consumption”  or  “remaining  life”  of  structural  components.  But 
providing  loads  are  known  for  a  special  structural  interface  or  component,  reliable  conclusions  can  be  drawn  regarding  local 
stresses  relating  to  the  manifold  of  load  cases  from  experience,  measurement  and  detailed  FE  analysis  during  design, 
qualification  and  test  phases  in  many  cases. 

In  addition  the  comparison  of  load  spectra  alone  may  already  be  suitable  for  drawing  conclusions  without  recourse  to  detail 
stress  calculations  of  specific  locations  for  components  with  limited  loadcase  variations  i.e.  landing  gears. 
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1.2  The  Determination  of  Design  Loads 

Design  loads,  better  “Initial  Design  Loads”  are  the  first  step  in  the  loads  history  of  an  airframe  that  influences  the  detail 
design  of  a  component  (i.e.  wing  or  fuselage  structure)  or,  at  a  later  stage  in  the  design  process,  a  part  (i.e.  wing  spar  cap  or 
fuselage  skin  panel)  in  many  details.  Since  not  every  load  is  determining  these  design  tasks,  establishment  and  identification 
of  the  “design  loadcases”  is  important.  The  following  is  a  summary  on  the  methods  how  design  loadcases  are  determined, 
with  special  attention  to  points  where  an  immediate  context  with  fatigue  calculations  exists. 

Fig.  1.2-1  shows  a  typical  “loads  loop”  which  usually  is  repeated  several  times  in  the  different  phases  of  the  aircraft  design. 
First  of  all  the  Structural  Design  Criteria  (SDC)  are  prepared  as  a  basis  for  design,  specifying  the  basic  performance  and 
flight  parameters,  then  a  Loads  Model  (LM)  is  built,  based  on  the  SDC’s,  the  aerodynamic,  flight  mechanic  and  weight  and 
balance  data  of  the  aircraft. 


Flight  Load  Simulation 


A/C  Component  Loads  Envelope 


Load  Distributions 
Balanced  Load  Cases 


Fig.  1.2-1  Loads  Loop 


The  loads  module  ensures  that  loadcases  selected  for  design  are  analysed  for  an  overall  balanced  aircraft  (mass,  inertia  and 
aerodynamic  forces)  for  all  manoeuvres  and  the  loads  analysis  is  performed  in  a  time  history  sequence,  thus  providing  load 
information  on  structural  interfaces  for  every  timestep  of  the  chosen  manoeuvre.  Results  of  the  loads  module  is  either 
continues  external  load  distribution  for  any  component  (i.e.  bending,  torque  and  shear  force  distribution  along  fuselage 
stations  for  all  loadcases  or  a)  distribution  of  loads  on  the  Finite  Element  (FE)  grid  nodal  points  for  subsequent  “global  FE- 
Analysis”. 

Thus,  starting  with  the  SDC  the  load  loop  ends  with  the  preparation  of  external  loads  for  stress  analysis  of  components. 

Usually  an  improved  or  changed  data  basis  results  in  an  update  of  the  LM  and  consequently  in  more  accurate  and  more 
detailed  design  load  cases.  Typical  improvements  are  a  better  aerodynamic  data  basis  (i.e.  via  extensive  windtunnel  testing) 
or  a  refined  FE-model  because  of  an  advanced  design  status.  Modifications  in  the  mass  and  balance  status,  control  laws  etc. 
may  also  result  in  substantial  changes  of  the  loads  model,  especially  in  advanced  computer  controlled  flight  vehicles. 

The  importance  of  the  link  between  knowledge  of  external  loads  and  structural  stress  distributions  for  the  assessment  of 
fatigue  life  cannot  be  underestimated.  Whereas  in  the  past  the  available  computer  resource  was  rather  poor  and  strong 
software  tools  were  scarce  goods,  leading  to  a  strong  selection  of  loadcases  to  be  analysed  in  detail,  today  there  are  virtually 
no  limits,  from  this  side.  Computers  power  do  play  an  important  part  with  respect  to  better  and  refined  results  in  the 
assessment  of  loads,  however  the  correct  selection  of  the  critical  manoeuvres  for  the  fatigue  spectrum  and  their  loads 
analysis  still  influences  the  fatigue  performance  of  a  structure  during  the  design  phase. 

Most  of  today’s  ageing  aircraft  fleets  of  the  NATO  airforces  were  designed  and  flight  tested  by  the  end  of  the  sixties  or  the 
beginning  seventies,  like  the  Tornado,  Harrier,  F-16,  F-18,  Mirage  2000  etc.  An  aircraft  like  the  F-4  Phantom  even  dates 
back  to  the  fifties  and  is  still  in  service  in  some  air  forces  of  the  alliance. 
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When  comparing  design  environments  of  the  a.m.  models  it  should  be  pointed  out  that  in  the  meantime  the  circumstances 
and  requirements  for  aircraft  design  and  analysis  have  changed  in  many  ways,  in  detail: 

•  much  better  tools,  soft-  and  hardware,  and  with  that  a  very  intensive  investigation  to  calculate  and  control  limit  and 
fatigue  loads  (including  a  substantial  increase  in  the  number  of  component  load  monitoring  stations) 


Tornado 

IDS 

Future 

Europ.Fighter 

Basic  Loads  Cases  (BLC) 
Flight  and  Ground 

Handling  Loads 

33 

105 

Unit  Loads  Cases  (ULC) 
Hammershock,  Engine 

Thrust,  Airbrake  etc. 

12 

16 

Combined  Load  Cases 
Superposition  of  scaled 

ULCs  to  BLCs 

~  100 

590 

•  more  accurate  loads  databases  in  terms  of 

advances  in  “Carefree  Handling”-  Flight  Control  Systems  (FCS) 
aircraft  mass  distributions  predictions 

aircraft  aerodynamics  calculated  with  mature  CFD  (Computational  Fluid  Dynamics)  methods  and  verified  earlier 
and  more  reliable  in  wind  tunnel  tests. 

-  coupling  of  structural  models  and  aerodynamic  models  for  aeroelastic  effects  available 

-  Finite  Element  modelling  of  the  structure  with  interfaces  to  the  Loads  Model 

•  extensive  flight  testing,  especially  dedicated  flight  load  surveys 

•  extensive  structural  ground  tests 

Basically  this  means  that  the  static  design  of  “old”  aircraft  usually  is  rather  conservative  and  on  the  safe  side. 

With  respect  to  fatigue  the  situation  is  often  less  satisfying,  i.e.  without  powerful  tools  like  a  balanced  Loads  Model,  one 
procedure  was  balancing  loads  over  the  aircraft  artificially  in  those  days,  and  design  loadcases  therefore  were  generated  for 
parts  of  the  structure  like  aft  or  forward  fuselage  or  tailplane  only,  the  effect  of  these  loads  on  other  areas  of  the  structure 
remained  unknown  and  components,  not  immediately  under  survey  were  not  analysed  for  this  loadcase,  therefore  the  effect 
of  changes  to  these  loadcases  later  remained  also  unknown. 

1.2.1  Structural  Design  Criteria  (SDC) 

Aircraft  loads  are  determined  according  to  requirements  and  regulations  collected  in  a  systems  specification  document 
called  Structural  Design  Criteria,  the  major  reference  for  loads  and  structural  analysis  engineers  during  the  design  phase. 
Many  of  the  SDC  requirements  come  from  the  customer,  others  are  prepared  in  co-operation  between  customer  and  original 
equipment  manufacturer  (OEM),  usually  the  principal  design  contractor.  The  SDC  are  also  subject  to  revisions  during  the 
design  process. 

Some  of  the  more  important  items  regarding  loads  and  structures  are: 

Design  masses  are  defined  for  different  flight  conditions  to  cover  the  whole  mass  and  center  of  gravity  (C.G.)  range,  i.e.: 

-  basic  flight  design  mass 

-  landing  design  mass 

-  maximum  take  off  mass 

Total  mass  and  mass  distribution  not  only  affect  loads  on  wing  as  is  sometimes  believed  but  loads  on  most  parts  of  the 
aircraft’s  structure.  Design  mass  is  one  of  the  most  important  criteria  for  structural  design.  For  example  the  basic  flight 
design  mass  is  coupled  to  the  max/min  allowed  vertical  load  factor  Nz,  for  increased  masses  through  the  rule:  Nz-Weight  = 
const,  to  avoid  overloads  or  assessing  the  effects  of  over-g’s. 

V-n  Diagrams  define  the  regime  of  speeds  in  combination  with  max/min  allowable  load  factor  Nz  including  gust  conditions, 
see  Fig.  1.2. 1-1.  For  low  speed  regimes  the  attainable  limit  Nz  depends  on  the  maximum  lift  and  dynamic  pressure  for  the 
wing  whereas  for  higher  speed  Nz  is  limited  by  the  structural  strength  of  the  aircraft.  The  v-n  diagram  is  referenced  to  a 
specific  mass  and  store  configuration,  i.e.  clean  wing  and  design  mass. 
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Fig.  1. 2.1-1  Ma-n  Diagram  in  Altitude 


Flight  Envelope(s)  define  the  operating  range  with  respect  to  Mach- Altitude  regime,  for  which  the  aircraft  is  designed. 
Limits  are  determined  by  attainable  Nz,  temperature  etc.  Fig.  1.2. 1-2  shows  a  typical  flight  envelope  for  the  Tornado 
aircraft. 


Mach  Number 


Fig.  1. 2.1-2  Altitude  -  Mach  Number  Envelopes 
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For  an  fixed  wing  aircraft  usually  only  one  flight  envelope  diagram  has  to  be  defined,  but  the  Tornado,  like  other  swept 
wing  designs,  presents  an  additional  complication  as  each  (fixed)  sweep  position  has  to  be  considered  as  a  different  aircraft. 
This  is  clearly  seen  by  the  different  flight  envelopes  for  the  shown  sweep  positions  of  the  wing. 

Fig.  1.2. 1-3  indicates  what  part  of  the  flight  envelope  is  of  importance  for  the  investigation  of  loads  and  shows  points  in  the 
Mach- Altitude  range  for  which  loads  are  calculated  according  to  the  scheme  explained  later.  The  points  are  selected  to  cover 
all  essential  effects  due  to  high  Nz,  incidence,  roll  rate,  gust,  Mach  effects  etc.  Traditionally  the  analysed  manoeuvres  could 
be  found  following  the  low  pressure  altitude  and  high  mach  number  boundary,  but  non-linear  aerodynamic  effects  of 
flexible  structure  and  the  modern  flight  control  layouts  are  the  reason  for  many  “interior”  points  in  the  Mach- Altitude  range 
(“points  in  the  sky”)  of  importance  for  today’s  loads  analysis. 


Mach  Number 

Fig.  1.2.1 -3  Mach  -  Altitude  Points  of  Loads  Model  (flex.  Aerodynamics) 


Environmental  Conditions  also  define  or  influence  tructural  loads  and  include 
System  pressures 
Cabin  and  fuselage  bay  pressures 
Temperatures  and  noise  levels 
Local  accelerations  for  qualification  of  equipment 
Vibration  levels 

Performance  Requirements  with  respect  to  steady  state  manoeuvres,  transition  response,  flight  and  ground  handling  qualities 
are  to  be  fulfilled. 

Example:  Due  to  aeroelastic  deformation  under  load  the  effectiveness  of  a  control  surface  may  be  reduced  substantially,  for 
differential  tail  design’s  even  roll  reversal  may  occur.  Therefore  a  typical  specification  would  be  the  max.  allowable 
degradation  in  control  efficiency  under  such  circumstances.  This  means  that  an  optimisation  of  the  flap  structure,  its  control 
devices  and  the  attached  structure  must  be  carried  out  to  ensure  a  required  roll  rate  for  a  given  control  input. 

Configuration  specification  with  respect  to  external  stores,  and  control  surface  schedules  like  high  lift  devices  ,  airbrakes  etc. 
Store  configuration  definitions  can  have  great  impact  on  fatigue  spectra  due  to  either  load  alleviation  or  increments  by 
inertia  effects  (stores  on  wing  versus  on  fuselage  ).  See  also  Chapter  1.3  for  a  discussion  and  example  of  component  load 
changes  due  to  store  configurations. 

Fatigue  Load  Spectra  are  defined  based  on  expected  usage  and  mission  schedules  for  the  aircraft  and  based  on  the  customer 
weapon  systems  specification.  Together  with  the  applied  scatterfactor  it  defines  the  loading  scenario  for  qualification  of  the 
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structural  design  through  analysis  and  ground  tests.  A  more  detailed  discussion  of  this  point  can  be  found  in  the  second 
paper  “LOADS  MONITORING  AND  HUMS”  of  this  Lecture  Series. 

1.2.2  Aircraft  Loads 

The  characteristics  of  loads  acting  on  aircraft  are  of  different  kind.  Although  non-exhaustive,  the  following  grouping  shall 
give  an  idea  of  the  “classes”  of  loads  to  be  considered  in  parallel  during  design: 

Quasi- static  loads: 

Flight  Loads: 

-  Symmetric  manoeuvres 

-  Asymmetric  manoeuvres 

-  Deep  and  flat  spin 

-  Gust  loads 

Ground  Handling: 

-  Take  off 

-  Landing 

-  Repaired  runway 

-  Taxiing  (asymmetric  braking,  turning  etc.) 

-  Towing,  Pivoting  etc. 

Local  and  Internal  Loads: 

-  Max./min.  aerodynamic  pressures  (outer  surfaces) 

-  Local  accelerations 

-  System  pressures 

-  Bay  pressures  (pressurised  areas) 

-  Hydrostatic  pressures  (  fuel  tanks) 

-  Intake  duct  pressures  (steady  state) 

-  Engine  thrust 

Dynamic  Loads: 

-  Buffet  (  Outer  wing,  vertical  fin  buffet  etc.) 

-  Dynamic  Gust 

-  Vibrations 

-  Acoustic  Noise 

-  Limit  cycle  oscillation 

-  Shimmy  (Undercarriage) 

-  Engine  hammershock  conditions  (Duct) 

Fatigue  Loads: 

Fatigue  load  cases  are  derived  from  the  a.m.  quasi-static  and  dynamic  load  conditions  if  the  frequency  of  the  respective  load 
cycle  is  sufficiently  high  during  the  assumed  usage.  Fatigue  loads  are  always  a  combination  of  loads  from  the  a.m.  list, 
especially  flight  loads  combined  with  local  and  internal  loads  or  acoustic  noise.  Other  loads,  occurring  only  during  failure 
situations  are  excluded  from  the  fatigue  load  sets  ( i.e.  engine  hammershock  will  certainly  not  be  a  fatigue  case),  Dynamic 
buffet,  although  difficult  to  predict,  needs  to  be  included  die  to  its  high  cycle  characteristic  and  therefore  high  damage 
potential. 

Flight  measured  buffet  on  a  vertical  fin  is  shown  in  Fig.  1. 2.2-1  for  a  symmetric,  no  side  slip  pitch-up  manoeuvre  to  50° 
AO  A,  indicating  bending  moments  Mx  and  torque  Mz  at  the  fin  root  with  R=-l,  picking  up  around  35°  AO  A  and  increasing 
to  the  max  angle  of  attack  flown  during  this  manoeuvre. 


60.000 


3TANDAJLD  ANGLE  OF  ATTACK  (  ALPHA  S) 
NOSE  BOOM  SIDESLIP  ANGLE  (  BETA  ) 
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1.2.3  Flight  Parameter  Envelopes 

Loads  are  not  a  function  of  Nz  alone  but  depend  on  many  other  flight  parameters,  the  most  important  are: 

Incidence  or  angle  of  attack  (AO A) 

-  Sideslip  (for  design  the  significant  factor  is  •  Q,  the  product  of  sideslip  and  dynamic  pressure) 

-  Control  surface  deflection  angles  (aileron,  rudder,  tailplane  etc.) 

-  Lateral  load  factor  Ny 

-  Vertical  load  factor  Nz 

Roll  rate  /  Roll  acceleration 
Pitch  acceleration 
Yaw  acceleration 

Usually  less  important  for  load  derivation: 

Longitudinal  load  factor  Nx 
Pitch  rate 
Yaw  rate 

Adequate  combinations  of  those  parameters  -  as  occurring  during  real  flight  manoeuvres  -  can  yield  high  loads  on  different 
parts  of  the  aircraft  structure,  even  for  rather  moderate  vertical  load  factors.  In  order  to  illustrate  this  context,  Fig.  1.2.3- 1 
shows  flight  parameters  during  a  typical  MIL-Std.  pitch  manoeuvre  versus  time  and  indicates  the  delay  between  command 
input  (tailplane  deflection  angle),  change  in  AoA  for  the  aircraft  and  the  increase  in  loadfactor  and  the  force  on  the  tailplane 
(=T/P  SHEAR),  the  value  for  the  loads  envelope  for  this  component. 


nz 

a 

q 

r|T/P 

T/P  SHEAR 


vertical  load  factor 
angle-of-attack 
pitch  acceleration 
tailplane  deflection  angle 
tailplane  vertical  shear  force 


Fig.  1. 2.3-1  MIL-SPEC  Pitch  Manoeuvre 


Therefore  it  is  the  engineers  skill  to  find  all  the  critical  combinations  for  the  different  aircraft  configurations  and  the  possible 
manoeuvres  within  the  whole  flight  regime.  Regulations  like  Mil-Spec  for  fighter  aircraft  or  FAR  for  other  A/C  provide  a 
good  guide  to  determine  the  critical  combinations  of  flight  parameters  for  design,  at  least  in  the  case  of  stable  aircraft  and 
conventional  FCS.  Very  often  it  is  desirable  to  determine  flight  parameter  values  from  response  calculations,  using  an 
aircraft  response  and  loads  simulation  program. 
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However,  in  the  early  and  intermediate  stages  of  modem  fighter  aircraft  design  a  reliable  model  of  an  FCS  usually  is 
unavailable,  therefore  agreement  between  specialists  of  different  disciplines  (aerodynamics,  flight  mechanics,  loads  etc.)  on 
flight  parameter  limits  in  the  form  of  envelopes  is  the  adequate  way  ahead.  Fig.  1.2. 3-2  shows  typical  envelopes  as  used  in 
the  early  design  phases  with  the  envelope  comers  design  critical  regions  for  different  aircraft  components. 


Rear  Fuselage 
Down  Loads 
Wing  Up 
Bending 
aftc.p. 


Front  Fuselage 
Up  Loads 
Wing  Down  Bending 
fwd  c.p. 


Front  Fuselage 
Down  Loads 
Wing  Up  Bending 
fwd  c.p. 


graph  up  left  graph  up  right 


(q-pr)  1/s 

Rear  Fuselage 
Up  Loads 

Wing  Down  Bending 


aftc.p. 


Wing  Torque  (pos.  nz) 
fwd/aft  c.p. 

Flap  Hinge 
Wing  Internal  Tank 


p,  p,  r,  r,  ny 
p,  p,  r,  r,  ny/max 

Wing  Torque  (neg.  nz) 
fwd/aft  c.p. 


Design  critical  regions 


Fig.  1. 2.3-2  Flight  Parameter  Envelopes  for  Structural  Design 


1.2.4  The  Loads  Model 

The  Loads  Model  is  the  central  tool  for  running  the  "loads-business".  It  presents  a  model  (on  computer)  of  the  total  aircraft, 
integrating  the  physics  of  motion,  the  aerodynamic  dataset,  stmctural  design  criteria  etc.  and  has  interfaces  to  other 
disciplines,  in  detail: 

A  collection  of  all  input  data  relevant  for  the  calculation  of  (static)  loads  like 

-  Wind  Tunnel  and  flight  test  aerodynamic  data 

-  FEM-grid  including  stiffness  matrix 

-  structural,  systems  and  role  equipment  masses  and  mass  distributions 

-  FCS  program  module  (for  simulation  of  flight  load  specific  manoeuvres  and  landing  cases) 

-  Aerodynamic  surface  grid 

provides  a  computer  program  to  determine  loads  and  load-specific  data  like: 

-  Pressure  distributions  as  a  function  of  Mach  number,  incidence,  control  deflections  on  all  surfaces 

-  Calculation  of  aeroelastic  effects  from  the  coupling  of  stmctural  flexibility  and  loads  (aerodynamic  and  inertia) 

-  Aerodynamic  derivatives  for  total  aircraft  (used  to  simulate  A/C  motion)  and  aircraft  component  aerodynamics, 
harmonised  with  respect  to  flight  test  and  wind  tunnel  data 

-  Manoeuvre  response  simulation  and  interface  loads 
(at  component  monitor  stations),  calculation  for 
preparation  of  component  loads  envelopes 

-  Landing  gear  model  and  landing  simulations  (flexible  aircraft)  with  structural  loads  calculations 

-  Generation  of  external  loads  distributions  along  stmcture  components  axis 

-  Distribution  of  design  loads  on  nodal  points  of  the  subsequent  FEM  for  stress  analysis 
and  makes  available  a  data  base  of 

-  Flexible  aerodynamics  (components  and  total  aircraft)  for  the  complete  Mach/Altitude  regime 

-  Manoeuvre  response  and  -load  cases 

-  Nodal  point  distributions  for  design  load  cases 
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One  of  the  focal  points  realised  by  the  Loads  Model  is  the  fact,  that  all  (design)  load  cases  are  calculated  as  balanced  load 
cases,  i.e.  all  conditions  with  respect  to  aerodynamics,  mass  distribution  and  flight  manoeuvre  match  and  provide  the 
correct  loads  for  each  structure  item  for  any  load  case.  In  other  words,  the  sum  of  net1}  forces  and  net  moments  at  all 
monitoring  sections  of  the  structure  must  be  zero: 

Lx,y,z  F(x,y,z)  =0  and  Ex,y>z  M(x,y,z)  =  0 

As  mentioned  above,  such  a  complete  Loads  Model  was  not  available  for  aircraft’s  developed  in  the  ’60  and  ’70. 

1.2.5  Aircraft  Component  Loads  and  -Design  Cases 

Loads  may  be  calculated  in  3  degrees  of  refinement: 

-  Interface  or  component  loads 

-  Load  distributions’,  e.g.  bending  moment  along  wing  span,  usually  one  dimensional 

-  Nodal  point  loads  for  Finite  Element  Analysis 

The  latter  two  are  suitable  to  stress  analysis  and  sizing  of  parts  and  are  usually  only  applied  to  design  load  cases.  Component 
loads,  however,  are  used  to  find  the  design  load  cases,  which  usually  are  different  for  individual  structure  locations. 
Therefore  the  A/C  structure  is  divided  in  components,  with  the  boundaries  representing  main  constructive  items  like 
interfaces,  bulkheads,  system  attachments  etc. 

An  example  can  be  seen  in  Fig.  1.2.5- 1,  showing  the  aircraft  components 


-  Wing 

-  Wing  spoiler 

-  Front  fuselage  transport  joint 

-  Fwd  front  fuselage 

-  Radom 

-  Rear  fuselage  transport  j  oint 

-  Taileron 

-  Fin 

-  Rudder 

-  Airbrake 


RADOME 


Fig.  1. 2.5-1  Load  Monitoring  Stations 


i) 


net  forces  /  loads  =  aerodynamic  load  +  inertia  load 
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The  respective  load  monitoring  stations  are  also  shown  in  the  figure,  where  probably  the  maximum  loads  are  acting.  For 
these  stations  the  forces  and  moments  are  calculated  for  the  whole  variety  of  possibly  critical  manoeuvres  (flight/landing 
conditions,  aircraft  configuration  and  mass  etc.  as  parameters)  resulting  in  at  least  one  loads  envelope  for  each  monitor 
station. 

Fig.  1.2. 5-2  illustrates  the  concept  of  load  envelopes  for  the  front  fuselage  and  the  wing  root.  Indicated  at  the  comer  points 
of  the  envelope  are  the  essential  conditions,  which  lead  to  the  design  loadcases. 


Fuselage  Loads  Envelope  at 
Front  Manufacturing  Joint 


Wing  Load  Envelope  (Clean  Config.) 


max.  neg.  "g"  incl.  25  % 
max.  lateral  bending 


max.  neg.  "g"  unsymm. 


combined  with  max. 
lateral  bending  (P,  ny) 


max.  pos.  "g"  unsymm. 


max.  pos.  "g"  incl.  25  % 
max.  lateral  bending 


Fig.  1. 2.5-2  Major  Aircraft  Component  Loads  Envelopes 


As  a  first  and  in  many  cases  correct  approximation  the  design  cases  can  be  selected  from  the  comer  points  of  the  different 
loads  envelopes. 

Usually  there  is  a  rather  unique  relation  between  corner  points  of  a  loads  envelope  and  the  flight  parameters  involved. 
Therefore  considering  modifications  in  the  aircraft’s  role  or  changes  in  equipment,  mass  or  performance  it  is  often 
straightforward  to  draw  conclusions  with  respect  to  component  load  changes  and  therefore  to  stress/fatigue  implications. 
This  aspect  is  discussed  in  chapter  2. 

To  illustrate  the  practical  sequence  of  steps  to  be  carried  out  in  order  to  calculate  a  flight  load  at  a  certain  structural 
component  a  typical  procedure  could  be  as  follows,  see  also  Fig.  1.2-1: 

1  Define  mass  and  c.g. 

2  Define  point  in  Mach- Altitude  range 

3  Define  sort  of  manoeuvre  (symmetric,  roll  man.,  combined  man.  etc.) 

4  Simulate  manoeuvre  and  calculate  response  parameters 

5  Calculate  external  net  loads  (forces  &  moments)  on  component  from  aerodynamic  pressures,  inertia  forces  etc. 

6  Convert  external  load  distribution  to  nodal  point  loads  on  FE  grid 

7  Analyse  stmcture  and  determine  local  stresses  (e.g.  NASTRAN) 
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1.3  Impact  of  Changes  (Mass,  Role,  etc.)  on  Component  Loads 

Forces  acting  on  an  A/C  caused  by  various  effects: 


Load 

Dependant  on  (list  not  Complete) 

Aerodynamic  loads 

Incidence,  sideslip,  control  angles,  Mach,  Altitude  etc. 

Inertia  loads 

Nx,  Ny,  Nz,  angular  ratesand  accelerations  etc. 

Engine  thrust 

Mach,  Alt.  Combat  thrust,  idle  etc. 

Internal  loads  e.g.  cabin  pressure 

Specs,  local  accelerations 

Actuator  forces  for  Control  surfaces 

Hinge  moment  =  f  (Mach,  Alt.) 

Hydrostatic  pressure 

Local  accelerations 

The  different  kind  of  forces  and  moments  contribute  to  the  loads  on  the  monitor  stations  in  a  different  manner.  The  front 
fuselage  up  bending  is  clearly  dominated  by  inertia  loads,  therefore  an  increase  in  the  front  fuselage  mass  will  result  in  a 
higher  front  fuselage  load,  see  Fig.  1.3-1 


Aero  ( aQ;a) 


FRONT  FUSELAGE 
TRANSPORT  J  OINT 


HFD  3000 


Fz 


Inertia  (n  z ;  Aryq)) 


Max.  down  bending  design  loads 


Air 

Inertia 

Net 

Vertical 

Shear  Force 

100 

-310 

-210 

Vertical 

100 

-480 

-380 

Bending  Moment 


Conclusion:  An  increasing  Front  Fuselage  mass  will  lead  to 
higher  Front  Fuselage  loading. 


Fig.  1.3.-1  Front  Fuselage  Transport  Joint  Critical  Load  Conditions 


This  is  not  an  fictitious  case,  Tornado  front  fuselage  mass  has  increased  over  the  years  and  so  the  current  critical  load  is 
definitely  higher  (max  15  %)  than  calculated  during  design. 

In  a  similar  manner  it  can  be  seen  that  the  rear  fuselage  monitor  station  is  dominated  by  inertia  loads  for  the  vertical 
bending,  but  aerodynamic  loading  (mainly  from  the  horizontal  tail)  increases  the  total  load,  in  contrast  to  the  front  fuselage 
case. 

Torque,  which  is  neglectable  for  the  front  fuselage  design,  plays  an  important  part  for  the  rear  fuselage  and  is  almost  entirely 
dominated  by  aerodynamic  forces  from  the  taileron  (differential  tail)  and  the  fin  (sideslip  and  rudder,  horizontal  gust),  which 
may  result  in  high  loads  during  rapid  roll  manoeuvres. 

Looking  at  the  wing,  it  is  clear  that  the  wing  bending  is  dominated  by  aerodynamic  forces  -  the  wing  has  mainly  to  carry  the 
aircrafts  weight  -  but  substantial  relief  come  from  inertia  forces  as  shown  in  Fig.  1.3-2. 
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Clean  Wing  -  dry  (Design  Condition) 


Air 

Inertia 

Net 

Normal  Force 

WO 

-15 

85 

Torsion 

WO 

-13 

87 

Bending 

WO 

-13 

87 

Clean  Wing  - 

wet 

Air 

Inertia 

Net 

Normal  Force 

100 

-24 

76 

Torsion 

100 

-19 

81 

Bending 

100 

-19 

81 

Clean  Wing  -  dry 

+  i/b  store  (350  kg) 

Air 

Inertia 

Net 

Normal  Force 

100 

-22 

78  % 

Torsion 

100 

-17 

83  % 

Bending 

100 

-17 

83  % 

Clean  Wing  -  dry  +  o/b  store  (350  kg) 

Air 

Inertia 

Net 

Normal  Force  100 

-22 

78 

Torsion  100 

-23 

77 

Bending  100 

-24 

76 

Conclusion:  Adding  mass  to  the  wing  (e.g.  carriage  of  stores) 
leads  to  reduced  wing  loads. 

Fig.  1.3.-2  Influence  of  Wing  Loading  Contitions  on  Wing  Loads 


As  indicated,  for  the  Tornado  the  wing  root  bending  moment  is  11%  less  carrying  outboard  stores  than  for  the  clean  wing 
without  stores. 

If  the  assumption  for  fatigue  design  includes  the  majority  of  missions,  flown  with  stores  on  the  outboard  wing  station,  this 
does  not  correspond  to  reality  and  although  the  overall  aircraft  mass  might  be  lower,  a  severe  reduction  in  lifetime  can  be  the 
result.  This  example  highlight’s,  how  changes  in  the  usage  and  configuration  affect  lifetime  and  how  this  can  be  assessed  by 
rather  simple  considerations. 

The  following  case  of  the  Tornado  undercarriage  also  shows  impact  of  how  design  loads  were  calculated  and  how  usage 
assumed  during  design  may  be  completely  different  from  real  life  usage  later: 

When  it  became  apparent  that  the  number  of  starts  and  landings  for  a  certain  squadron  was  much  higher  than  projected  the 
conclusion  was  that  the  nominal  lifetime  of  the  squadron’s  aircraft  was  exhausted,  at  least  with  respect  to  the  landing  gear 
and  the  support  structure.  The  question  arose,  whether  lifetime  could  be  prolonged  and  an  investigation  came  to  the 
following  conclusions: 

-  Design  of  the  landing  gear  was  based  on  the  assumption  of  dry  runway  conditions.  Dry  runway  landing  yields  higher 
loads  because  of  an  high  friction  coefficient.  But  in  reality  dry  runway  landings  occurred  much  less  than  expected, 
lifetime  could  be  extended. 

-  At  the  same  time  takeoff  and  landing  mass  had  increased  relative  to  the  design  landing  weight,  causing  a  lifetime 
reduction. 

-  Assumptions  during  design  that  approximately  50%  of  all  landings  would  be  3-point  landings  were  completely  unrealistic 
for  this  squadron.  As  only  about  10%  of  all  landings  were  identified  to  be  3-point  landings,  the  nose  landing  gear  could 
be  expected  to  have  a  far  longer  lifetime  than  projected. 

-  Overall  methods  (e.g.  MIL)  often  result  in  safe  but  unrealistic  loads.  A  detailed  analysis  of  landing  simulations  led  to 
more  accurate  loads  and  therefore  to  a  far  better  assessment  of  landing  gear  lifetime. 

Considering  all  the  a.m.  points  together  sufficient  life  for  projected  usage  of  airframes  for  this  squadron  could  be  guaranteed. 

1.4  Qualification  of  Loads,  Static  and  Dynamic  Tests 

Static  and  dynamic  loads  critical  for  the  structure  are  checked  not  only  during  the  early  stages  of  aircraft  operational  flight 
test  but  previously  through  ground  tests  as  required  by  the  certification  procedures  for  the  individual  aircraft  type. 

The  major  milestones  for  ground  testing  are  the  ground  resonance  Test  (GRT)  to  check  dynamic  structural  response  and 
confirm  flutter  margins  established  analytically  to  prevent  flutter  during  initial  flight  tests,  the  "Major  Airframe  Static  Test" 
(MAST)  and  the  "Major  Airframe  Fatigue  Test"  (MAFT)  for  critical  loadcases  identified  during  structural  analysis.  The 
loads  for  both  tests  coincide  with  the  loadset  used  during  the  development  phase,  a  requirement  critical  for  validation  of 
analytical  results. 

One  possibility  to  prove  the  correctness  of  loads  itself  can  be  done  by  wind  tunnel  measurements  (pressure  plotting  wind 
tunnel  model  or  component  balances)  and/or  modern  flight  load  survey.  Flight  load  survey  provides  information  from  exact 
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in-flight  pressure  measurements  which,  together  with  wind  tunnel  data,  is  fed  back  to  the  aerodynamic  model  of  the  aircraft 
and  leads  to  an  update  of  the  Loads  Model,  including  other  reference  data  (masses  etc.).  Then  critical  load  cases  are 
recalculated  and  thereby  confirm/update  design  load  calculations.  A  typical  layout  of  pressure  measurement  locations  for 
flight  test  is  shown  on  Fig.  1.4-1. 


Pressure  Transducer 
Layout  for  Fin 
and  Rudder 


Pressure  Transducer  Stations  for  Starboard  Fuselage 


Pressure  Transducer  Layout 
for  Upper  Wing  Surface 


Pressure  Transducer 
Layout  for  Foreplane 


Taps  at  Pressure  Plotting 
Wind  Tunnel  Model 


Fig.  1.4- 1  Prototype  Pressure  Plotting  for  Flight  Load  Survey 


A  further  procedure  to  gather  flight  loads  data  is  by  measuring  net  loads  with  calibrated  strain  gauges  on  test  aircraft’s. 

2.  AIRCRAFT  ANALYSIS  USING  STATIC  LOADS  AND  FATIGUE  LOADS  SPECTRA 
2.1  Static  load  conditions  and  fatigue  spectrum  generation 

Safety  of  flight  for  any  aircraft  rely  on  the  recognition  that  the  structure  must  withstand  maximum  static  loads  as  well  as 
repeated  loads  in  addition  to  a  certain  amount  of  manufacturing  defects  and  in-service  damage  throughout  the  service  life 
without  detrimental  degradation  of  the  structure  leading  to  catastrophic  failure  of  components.  The  two  major  tools  for 
achieving  this  are  the  engineering  analysis  in  accordance  with  the  Structural  Design  Requirements  (SDR)  and  fleet 
inspection  programs. 

The  SDR  documented  in  the  aircraft  weapon  systems  specification  are  the  background  for  the  set  of  loadcases  to  be 
addressed  during  the  sizing  of  the  different  aircraft  components. 

In  general  these  loadsets  can  be  divided  into  the  following  groups: 

*  Limit  loadcases 

(relevant  for  fatigue  design  requirements) 

*  Ultimate  loadcases 

(relevant  for  static  strength  requirements) 

*  Special  loadcases 

(i.e.  birdstrike,  crash,  weapon  release,  buffet,  etc.) 

The  defined  set  of  missions  for  the  aircraft  configuration  is  the  base  for  the  generation  of  static  and  fatigue  loadcases,  which 
the  structure  should  withstand  throughout  its  intended  service  usage  under  defined  environmental  conditions,  demonstrated 
through  engineering  analysis  in  the  development  phase  and  proofed  via  full  scale  testing  (static  ultimate  and  fatigue)  later. 
Typical  static  loads  criteria  for  a  "care  free  handling  "-flight  control  system  equipped  aircraft  are  shown  in  Fig.  2.1-1. 
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STATIC  LOADS  DESIGN  CRITERIA 


Two  Load  Levels:  Design  Limit  Load  (DLL)  =  Max.  Operational  Load  in  Service 

Design  Ultimate  Load  (DLL)  =  Failure  Load  of  Structural  Components 


Ultimate  Load: 


Ultimate  Load: 


1.4  x  Limit  Load 

for  all  Loadcases  controlled  by  FCS 

1.5  x  limit  Load 

for  all  loadcases  not  controlled  by  FCS 

e.g.  undercarriage  cases,  actuator  loads,  store  attachments  etc. 


Requirements:  No  structural  failure  at  DUL 

No  permanent  deformation  at  DLL 
Buckling  of  panels  must  remain  elastic  at  DLL 

No  buckling  at  DUL  for  items  where  structural  integrity  is  affected  by  stability 
No  buckling  up  to  110%  DLL  for  items  where  operational  function  is  affected  by 
stability 


Fig.  2.1- 1  Static  Loads  Design  Criteria  for  Airframes 


The  results  of  the  calculations  are  documented  in  "Static  Strength  Reports"  for  each  part  and  form  the  input  during  the  flight 
envelope  expansion  phase  from  the  structural  side,  the  so-called  "Strength  Envelope". 

Durability  or  fatigue  criteria  are  extracted  from  the  planned/defined  mission  profile  and  combined  with  the  overall  life 
requirements  in  term  of  flight  hours  (FH)  and/or  flights  within  a  defined  timeframe  of  service  years.  If  several  aircraft  roles 
are  defined  in  the  specification,  overall  life  is  split  into  Flights/Mission,  appropriate  representation  of  fatigue  critical 
conditions  within  the  fatigue  spectrum  is  essential. 

Manoeuvre  loads  are  covered  by  an  "overall  g-spectrum"  for  the  prime  aircraft  missions,  i.e.  Air-to-Air  or  Air-to-Ground  as 
"Points  in  the  Sky"  for  a  given  Mach/Altitude  level  and  A/C-Weight/Store-configuration.  Excedance  curves  are  then 
generated  as  shown  in  Fig.  2.1-2  for  combat  aircraft. 


Fig.  2.1-  2  Typical  Excedance  Curves  for  Combat  Aircraft 
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Special  load  spectra  are  needed  for  components  like  control  surfaces,  airbrakes,  engine  mounts,  stores  or  landing  gear. 

For  transport  A/C  cabin  pressure  cycles  are  an  important  factor  for  fuselage  durability  together  with  gust  spectra. 

The  various  loading  spectra  form  the  basis  for  the  fatigue  or  fracture  mechanics  analysis  depending  on  the  design  concept  - 
Safe  Life  or  Damage  Tolerance-  adopted. 

2.2  Conversion  of  ’’external  loads”  into  structural  airframe  loads 

For  the  static  and  dynamic  analysis  of  airframe  structures  a  mathematical  model  of  the  aircraft  is  build  using  the  Finite 
Element  Analysis  (FEA)  -technique,  representing  the  geometry  and  structural  stiffness  of  the  major  items  and  providing  the 
bases  for  generation  of  "internal"  structural  forces  in  components  like  bulkheads,  longerons,  skins,  spars  and  ribs  etc.  as  well 
as  other  important  information  like  maximum  deformation  of  parts  under  loads.  The  detailing  of  these  FE-models  depend  on 
the  different  phases  within  the  iterative  process  and  has  improved  dramatically  with  computer  performance  and  modern  Pre- 
and  Post-processing  capabilities  in  recent  years.  "Global"  coarse  mesh  models  are  used  to  analyse  load  paths  in  the  overall 
structure  of  aircraft  or  large  components.  "Local"  models  in  general  are  more  detailed  and  they  do  simulate  the  special 
stiffness  distribution  like  thickness  changes,  cut-outs  etc.  Structural  trade-off  studies  with  this  techniques  in  all  phases  of 
airframe  development  are  standard  procedures  for  some  years,  computer  based  optimisation  of  major  elements  like  skin 
thicknesses  are  used  today  in  early  design  stages.  A  decrease  of  computer  cost  and  processing  time,  and  in  parallel  the 
improvement  of  model  generation,  linking  the  design  software  (i.e.  CATIA)  with  the  loads  model  output  of  FEA-nodal 
forces  and  the  finite  element  solver  through  pre-processors,  will  continue  this  trend  towards  more  detailed  models,  better 
(and  more)  pre/post-processing  information  but  also  increased  number  of  loadcases  and  refined  component  loads  as 
discussed  in  chapter  1.2. 

Fig.  2.2-1  shows  a  typical  "coarse  mesh"-finite  element  model  of  a  wing  structure  with  wing  box  and  flaps,  where  40-50 
"design  loadcases"  were  identified  from  the  loads  database  of  500  load  conditions  and  used  for  subsequent  strength  analysis. 


Fig.  2.2-1  Coarse  Mesh  FE-Model  of  Wing  Structure 
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Fig.  2.2-2  shows  a  similar  model  of  a  center  fuselage  for  a  fighter  aircraft,  cut  at  YO-station  for  symetrie. 


Fig.  2.2-2  FE-Half-Model  of  Center  Fuselage  Structure 


The  general  trend  in  international  programs  towards  development  and  production-workshare  is  mirrored  in  the  global  finite 
element  model  as  well  as  through  superelement  techniques  requiring  detailed  data  transfer  checks  and-  protocol 
requirements.  The  Eurofighter  global  model  shown  in  Fig.  2.2-3  was  generated  by  5  European  aircraft  companies  on 
different  computer  hardware  and  operating  systems,  therefore  model  compatibility  and  -quality  checks  were  essential  during 
the  so-called  "Check  Stress  Full  A/C-  Finite  Element  Model  Static  and  Dynamic  Assembly".  The  overall  model  size  is  about 
35000  elements  and  more  than  580  loadcases  after  superposition.  After  the  unified  analysis  the  results  were  transferred  back 
to  each  company  for  further  processing  and  structural  analysis. 


Fig.  2.2-3  EF2000  Global  Model  for  Unified  Analysis 
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To  further  detail  the  loads  in  components  and  individual  parts  for  actual  sizing  of  the  structural  members,  a  "cut-out"  of  the 
global  model  with  the  exact  bondary  conditions  applied  to  the  “edges”  of  the  component  of  interest  from  the  results  of  the 
global  model  is  possible  and  often  used  for  detail  investigations  like  effects  of  local  cut-outs,  reinforcements,  stability 
checks,  etc. 

Fig.  2.2-4A  and  2.2-4B  shows  an  example  of  this  technique  for  a  center  fuselage  bulkhead. 


Fig.  2.2-4A  Coarse  Mesh  FE-Model  of  Cemter  Fuselage  Frame 


Fig.  2.2-4B  Fine  Mesh  FE-Model  for  Detail  Analysis 


The  results  of  these  detailed  model  technique  provide  the  background  for  strength  analysis  of  static  ultimate  loads  as  well  as 
fatigue  loadcases  in  accordance  with  the  allowable  for  the  materials  used  and  the  geometric  effects  in  the  design. 
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Abstract 

Aircraft  corrosion  is  a  never-ending  challenge  where  prevention  and  control  play  the  fundamental  role  of 
ensuring  the  airworthiness  requested. 

Corrosion  prevention  moves  from  design  optimization  and  proper  material  selection,  but  it  includes  much 
more  following  phases  like  a  correct  finish  specification  and  plans  for  effective  maintenance,  inspection  and 
repair. 

Corrosion  control,  in  this  meaning  including  prediction  and  diagnostics,  is  complementary  to  prevention  and  it 
is  actually  the  field  where  more  efforts  are  provided,  because  early  corrosion  detection  is  the  easiest  way  to 
avoid  costly  aircraft  damage  or  failures. 

In  effect,  considering  that  corrosion  can  account  for  60%  of  all  maintenance  and  repair  costs,  economic 
factors  must  be  considered  as  the  most  important  constraint  affecting  both  prevention  and  control. 

In  this  lecture  the  attention  will  be  focused  on  the  different  corrosion  prevention  and  control  strategies  adopted 
and  their  actual  modifications  in  accordance  with  the  exacerbation  of  the  aging  aircraft  issues. 

1.  INTRODUCTION 

Control  and  prevention  are  both  issues  used  to  describe  the  procedures  necessary  to  provide  an  effective 
corrosion  maintenance  on  aircraft. 

In  effect  they  must  be  considered  as  complementary  because  corrosion  and  prevention  can  have  a  synergistic 
effect  when  each  one  explicates  its  specific  action.  However,  it  is  important  to  remember  that  corrosion 
control  includes: 

■  Corrosion  detection 

■  Corrosion  removal 

■  Renewing  the  protective  systems 

On  the  other  side,  corrosion  prevention  is  devoted  to: 

■  Material  design 

■  Surface  treatments,  finishes  and  coatings 

■  Corrosion  inhibitors  compounds  and  sealants 

■  Preservation  techniques 

The  entire  process  including  all  these  phases  has  been  recently  called  corrosion  surveillance1,  indicating  the 
increasing  interest  from  aircraft  operators  in  this  matter,  largely  due  to  the  growing  number  of  aging  fleets. 

For  many  years  “find  and  fix”  has  been  the  maintenance  philosophy  all  over  adopted  but  now  that  aircraft  are 
being  flown  beyond  their  design  life,  this  practice  will  not  allow  a  safe  and  cost  effective  management  of  the 
fleets2. 

So  corrosion  control  and  prevention  both  improved  in  many  aspects  in  the  last  decade  where  environmental 
constraints  also  played  a  very  important  role. 

2.  CORROSION  CONTROL 

Many  significant  advances  have  been  done  in  this  field  and  probably  more  are  expected  in  the  near  future. 

In  the  past,  control  procedures  were  just  related  to  scheduled  maintenance,  non-destructive  evaluation  and 
repair  but  now  early  diagnostic,  condition  based  maintenance  and  paint  removal  technologies  are  some  of  the 
most  interesting  areas  where  impressive  improvements  are  continuously  carried  out. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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2.1  Corrosion  Detection  and  Monitoring 

Several  NDT  were  used  since  many  years  to  detect  corrosion,  the  most  commons  of  them  being: 

•  Visual  inspection 

•  Magnetic  particle  flaw  detection 

•  X-ray 

•  Ultrasonic  inspection 

•  Eddy  current 

•  Dye  penetrants 

However,  the  increasing  corrosion  costs  recently  introduced  the  need  to  obtain  an  early  detection  and,  at  the 
same  time,  to  reduce  the  unnecessary  inspections. 

Monitoring  during  service  became  the  key  of  this  new  approach  and  as  a  consequence  of  that  different 
strategies  were  investigated. 

Corrosion  data  collection  and  analysis3  carried  out  in  order  to  evaluate  the  areas  most  affected,  estimate  the 
costs  and  plan  the  priority  of  intervention,  should  be  considered  as  the  first  stage,  followed  by  the 
development  of  in-situ  monitoring  systems. 

Thin  film  Au-Cd  galvanic  sensors4  were  developed  and  successfully  installed  on  military  aircraft  for 
monitoring  hidden  corrosion  or  corrosivity  in  aircraft  interiors,  sealants  and  coatings5.  These  bimetallic 
sensors  are  kept  isolated  until  moisture  from  the  environment  bridges  the  two  electrodes:  when  it  occurs  the 
sensors  will  develop  a  galvanic  current  directly  proportional  to  the  corrosivity  of  the  trapped  moisture.  In 
harsh  environments  Ni-Au  sensors  are  recommended  to  provide  a  long  term  life. 

Promising  investigations  are  being  actually  carried  out  to  incorporate  fluorescence  based  sensors  into  paint 
coatings  to  provide  an  easy  and  economic  means  to  detect  corrosion6. 

At  the  same  time,  new  technologies  are  more  and  more  used  to  reduce  the  time  consuming  corrosion  control 
activity,  and  in  this  area  the  Thermal  Wave  NDI7  that  uses  an  IR  video  camera  to  image  the  surface  of  the 
aircraft  after  the  application  of  a  short  pulse  oh  heat  seems  very  interesting  as  far  as  the  Double  Pass 
retroreflection  Aircraft  Inspection  System  (DAIS)8. 

An  user  friendly  probe  with  a  high  degree  of  accuracy  and  sensitivity,  based  on  Electrochemical  impedance 
(El)  measurements9  has  also  been  developed. 

2.2  Paint  and  Corrosion  Removal 

Corrosion  control  on  aircraft  often  need  paint  removal  but  today  chemical  stripping  is  no  longer  the  only  way 
to  achieve  it:  diffusion  of  composite  materials,  environmental  regulations  and  health  and  safety  considerations 
are  eroding  such  a  monopoly. 

New  technologies  have  been  investigated,  some  of  them  are  widely  used,  first  of  all  Plastic  Media  Stripping 
(Fig.  1),  a  method  that  involves  subjecting  the  paint  surface  to  a  high  pressure  stream  of  acrylic  particles,  or 
its  closest  variation  that  uses  natural  products  (wheat  starch)  as  the  stripping  medium. 


Fig.  1  -  IAF  Tornado  stripped  by  means  of  Plastic  Media 
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However,  these  techniques  need  special  care  and  are  strongly  dependent  on  the  operator  ability:  wrong  swell 
times  or  stream  pressure  could  remove  the  clad  on  aluminum  parts  or  produce  damage  on  composite  materials. 
Researches  are  in  progress  to  evaluate  safe  and  cost  effective  alternative  solutions:  at  the  moment  the  two 
more  attractive  options  seem  : 

>  Flashjet 

(a  Xenon  flashlamp  with  carbon  dioxide  pellet) 

>  Hand  held  laser 

Though  at  an  early  stage  of  development,  interesting,  at  least  for  components,  seems  to  be  a  photochemical 
process  that  uses  only  waterborne  stripping  media  with  no  organic  solvents10. 

Once  detected,  corrosion  must  be  removed  by  means  a  pickling  operation  also  necessary  as  a  surface 
preparation  for  the  following  treatments. 

Even  in  this  field,  environmental  compliance  needs  to  substitute  the  traditional  solpho-chromic  pickling  with  a 
chromate-free  alternative. 

In  this  sense  a  hot  sulfuric-ferric  acid  mix11  showed  at  the  moment  the  best  performance. 

3.  CORROSION  PROTECTION 

Many  factors  have  to  be  taken  into  account  in  order  to  carry  out  an  effective  corrosion  prevention,  most  of 
them  are  being  strongly  correlated. 

Of  course,  the  starting  point  must  be  the  materials  design  that  will  depend  not  just  on  its  corrosion  behavior 
but,  often  more  than  this,  on  its  mechanical  properties. 

Once  chosen  the  material,  its  corrosion  behavior  will  not  be  fixed  unless  surface  treatments,  finishes,  coatings 
and  operating  environment  are  not  clearly  identified. 

Aging  aircraft  and  environmentally  acceptability  have  deeply  modified  old  concepts  and  rules,  making  of  all 
this  matter  a  big  deal  of  research  and  development  of  technologies12. 

3.1  Materials 

With  regard  to  the  materials,  if  it  is  true  that  in  the  design  of  new  aircraft  there  exists  a  trend  towards  plastics, 
nevertheless,  aging  fleet  requires  in  many  cases  the  substitution  of  alloys  with  equivalent  strength  but  with 
higher  corrosion  resistance  in  order  to  extend  maintenance  schedules  and  decrease  down  time. 

Particular  attention  is  given  to  some  of  the  most  dangerous  forms  of  corrosion  as  Stress  Corrosion  Cracking 
(SCC)  and  Exfoliation. 

On  aluminum  alloys,  the  most  interesting  performances  have  been  achieved  by  means  of  the  new  tempers  (in 
particular  the  Til)  that  allows  to  have  a  better  control  of  the  size,  the  spatial  distribution  and  the  copper 
content  of  the  strengthening  precipitates1314. 

The  7055-T77,  provides  an  high  resistance  to  intergranular  corrosion,  exfoliation  and  SCC,  attributed  to  its 
high  ratio  of  Zn:Mg  and  Cu:Mg  and,  as  a  consequence  of  that,  an  optimum  microstructure  at  and  near  grain 
boundaries15. 

Chemical  composition  improvements,  finalized  at  a  lower  Fe  and  Si  content,  have  brought  reduction  to  pitting 
initiation  on  aluminum  alloys  series  2xxx.  2024-T3  suffers  in  effect  pitting  corrosion  attack,  and  this 
phenomenon  is  strongly  dependent  on  the  Fe  and  Si  bearing  second-phase  constituent  particles16:  the 
reduction  of  their  density  and  size  achieved  on  the  derivative  alloy  2524-T3,  resulted  in  a  reduction  of  the  pits 
nucleation  that  can  act  as  potential  initiation  of  fatigue  cracks. 

3.2  Surface  Treatments,  Finishes  and  Coatings 

Chromate  based  pre-treatments  and  chromate  pigmented  primers  are  extensively  used  in  the  corrosion 
protection  of  aluminum  alloys  because  of  their  excellent  performance. 

However,  many  investigations  about  chromate-free  protection  schemes  have  been  undertaken  since  about  ten 
years  and  some  of  them  (cerium  salts,  nickel  metavanadate17,  Phosphoric  Sulfuric  Acid  anodizing18,  etc.)  have 
already  given  promising  results. 

A  non-toxic  trivalent  chromium  conversion  coating  formed  applying  dilute  solutions  of  basic  chromic  sulfate 
plus  hexafluorozirconate  has  been  already  successfully  proposed19;  it  appears  at  the  same  time  also  promising 
for  applications  to  cadmium  and  zinc-nickel  coated  steels. 
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Anyway,  just  cadmium  plating  process,  able  to  provide  an  effective  corrosion  sacrifical  protection  and  high 
lubricity  on  high  strength  steels,  will  be  no  longer  allowed  even  in  military  and  aerospace  applications;  its 
main  disadvantages  is  the  toxicity  of  the  cyanide  baths. 

Many  studies  have  been  started  and  investigations  are  still  in  progress  to  evaluate  the  best  alternative  process 
(zinc-nickel  or  zinc-cobalt-iron  electrodeposition,  metallic-ceramic  consisting  of  aluminum  particles  in  an 
organic  matrix  spray,  etc.)20 

3.3  Corrosion  Preventive  Compounds  and  Sealants 

Corrosion  preventive  compounds  (CPC)  are  able  to  explicate  a  really  effective  corrosion  protection,  and  their 
use  is  considered  essential  to  procrastinate  the  corrosion  initiation,  extend  the  scheduled  maintenance  and 
reduce  costs. 

They  explicate  a  combined  effect:  isolating  the  metal  surface  from  the  environment  (barrier  effect)  by  means 
of  a  water  displacing  action  carried  out  by  the  wax  base,  and  modifying  the  local  environment  to  make  it  less 
aggressive  (active  effect)  by  means  of  the  inhibitors  included  in  their  formulation. 

CPC  will  be  consumed  and  as  a  consequence  of  that  they  must  be  renewed  with  a  frequency  dependent  on  the 
environmental  aggressiveness  they  will  be  exposed,  usually  every  two  years. 

Here  the  environmental  compliance  forces  the  R&D  to  look  at  new  products  reducing  the  VOC  content. 

Sealants  and  jointing  compounds  on  the  other  hand  are  necessary  to  avoid  both  galvanic  coupling  between 
dissimilar  metals  and  crevice  corrosion  that  could  act  as  nucleation  points  for  fatigue  crack  propagation. 

It’s  important  to  remember  that  effectiveness  of  the  protective  measures  both  by  sealants  and  CPC  depends  on 
a  good  preparation  and  proper  application;  it  means  that  specialists  training  is  a  decisive  step  in  corrosion 
prevention. 

3.4  Preservation  techniques 

Preservation  is  a  really  wide  area  that  includes  many  different  actions.  The  most  common  preservation 
technique  is  washing  and  rinsing  the  aircraft  after  each  mission,  mostly  when  it  was  a  low-high  mission  on  the 
sea:  to  eliminate  chloride  and  salts  from  the  metal  surface  in  this  case  is  considered  a  must. 

Usually  preservation  is  conceived  in  agreement  with  three  different  strategies,  depending  on  the  preservation 
time: 

•  short  term  (0-90  days)  preservation 

•  medium  term  (up  to  1  year)  preservation 

•  long  term  (beyond  1  year)  preservation 

When  long  term  preservation  is  required,  dehumidification  is  necessary. 

In  any  case,  more  is  the  preservation  time  and  less  will  be  the  manhours  spent  on  maintenance. 

Sometimes  can  be  necessary  to  protect  the  aircraft  or  part  of  it  for  a  long  time  from  contamination  and  the 
effects  of  high  relative  humidity  by  means  of  a  barrier  material.  This  is  the  case  of  the  Nitrogen  Purging 
Packaging  (NPP)  System21,  that  uses  a  flexible  barrier  to  form  a  cocoon  around  the  object  to  be  protected  and 
the  inner  atmosphere  is  modified  to  achieve  the  desired  level  of  relative  humidity. 

4.  SUMMARY 

Corrosion  prevention  and  control  have  been  separately  described  in  this  presentation  in  order  to  deal  with  the 
most  interesting  concerns  in  their  respective  matters,  although  they  represent  a  continuous  that  can  be 
summarized  as  corrosion  surveillance. 

They  cover  many  different  areas  and  represent  a  really  multidisciplinary  subject  strongly  related  to 
airworthiness. 

This  paper  contains  a  selection  of  the  numerous  studies  and  investigations  that  have  been  undertaken  in  the 
recent  past,  many  of  them  being  still  in  progress,  to  ensure  an  effective  corrosion  protection  and  control  under 
the  aging  aircraft  and  the  environmental  constraints. 
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Today,  safety  is  considered  to  be  of  highest  importance  in  most  societies.  In  the  context  of  the  military,  safety  is 
essential  to  averting  loss  of  life  and  damage  to  a  high-value  asset.  While  safety  may  take  second  place  to  winning  a  war, 
its  importance  is  further  accentuated  because  of  its  connotation  to  battlefield  readiness.  There  have  been  numerous 
instances  to  illustrate  this  last  point.  To  wit: 

Widespread  Fatigue  Damage  (WFD)  was  discovered  in  "weep  holes"  of  fuel  tanks  of  some  C-141  military 
transport  airplanes.  Because  of  the  loss  of  minimum  residual  strength,  with  the  attendant  risk  of  catastrophic  fracture 
posed  by  WFD,  the  entire  fleet  had  to  be  grounded  and  an  expensive  refurbishment  program  had  to  be  undertaken  before 
the  fleet  was  deemed  to  be  airworthy.  In  this  instance,  the  unsafe  condition  was  detected  and  corrected  quickly,  so  no 
lives  were  lost  nor  did  any  of  the  airplanes  in  the  fleet  suffer  catastrophic  damage.  However,  the  grounded  aircraft  were 
certainly  not  battle-ready  for  a  certain  length  of  time.  Had  they  been  sent  into  battle,  they  would  have  had  to  be  operated 
under  severe  flight  restrictions  and,  thus,  their  utility  to  serve  the  purpose  of  the  deployed  forces  would  have  been  very 
restricted.  Had  they  been  deployed  without  any  restrictions,  in  all  probability  they  would  have  been  unable  to  complete 
their  missions  and  the  Air  Force  could  have  lost  valuable  aircraft  assets.  Also,  the  necessary  logistic  support  to  properly 
carry  out  tactical  operations  in  the  battlefield  would  not  have  been  available. 

WFD  was  the  primary  cause  of  a  highly  publicized  air  accident  involving  a  commercial  aircraft.  The  wide 
publicity  given  to  that  single  accident,  abetted  by  on-site  video  tape  recording  of  the  condition  of  the  aircraft  after  it  had 
landed,  shook  the  confidence  of  the  public  in  the  safety  of  commercial  aviation.  As  a  result,  inspection  and  refurbishment 
of  3000  jet  transport  airplanes  among  a  fleet  of  about  5000  was  mandated  by  the  authorities,  to  be  undertaken  on  an 
urgent  basis.  The  economic  impact  of  this  mandate  on  the  airlines,  the  aircraft  manufacturer  and  the  flying  public  was 
high  and  resulted  in  numerous  complaints  to  the  regulatory  authorities.  It  must  be  noted  that  since  that  time  more  than 
twelve  years  have  elapsed  without  a  single  accident  attributable  to  WFD. 

These  instances  explain  my  motivation  for  including  the  subject  of  safety  during  this  Lecture  Series.  However, 
the  subject  is  extensive  and  so  many  books  have  appeared  that  address  some  aspect  or  the  other  that  my  remarks  are 
meant  to  complement  the  existing  literature.  Much  of  what  I  intend  to  share  with  you  today  is  not  something  I  have 
developed  on  my  own,  rather  it  has  been  influenced  by  my  comrades  and  peers  when  I  was  in  the  civil  aviation 
community. 

Scope  of  the  Lecture  -  Analysis  and  Data  Requirements  for  Assessment  of  Operational  Safety: 

An  aircraft  is  an  assemblage  of  complex  and  highly  integrated  sub-systems  -  the  structure,  the  power-plant,  the 
electrical,  the  mechanical,  and  hydraulic  systems,  the  avionics  suite,  the  human-in-the-loop  to  name  a  few.  To  eliminate 
the  risk  of  the  sub-systems  to  fail,  individually  or  in  concert,  safety  analyses  are  routinely  performed  by  aircraft 
manufacturers.  The  manufacturer  also  conducts  analyses  to  ascertain  the  consequence  of  a  failed  part  to  assure  that  it 
does  not  in  any  way  threaten  the  safety  of  the  entire  system. 

Before  an  aircraft  model  enters  service,  whether  for  military  or  civil  use,  the  design  has  to  satisfy  a  rigorous  set 
of  requirements,  which  are  governed  by  regulations.  These  requirements  include  an  analysis  of  the  probability  of  failure 
of  each  component  and  the  hazard  caused  by  the  failure.  This  subject,  termed  as  "Systemic  Safety  [1],"  will  be  beyond 
the  scope  of  this  lecture.  Rather,  the  remarks  will  concentrate  on  the  operational  phase  of  the  aircraft's  life.  That  is  the 
phase  subsequent  to  the  aircraft  put  into  operational  use  for  the  first  time. 

However,  keep  in  mind  that  before  the  aircraft  enters  the  fleet,  there  are  numerous  design  reviews,  ground  and 
flight  tests,  and  production  approvals  that  are  required  to  assure  that  the  aircraft  is  safe  and  able  to  perform  as  intended  in 
the  operating  environment.  At  times,  the  origin  of  problems  that  are  encountered  in  service  may  be  inherent  in  the  design 
or  the  manufacturing  stage  or  due  to  construction  methods.  For  instance,  an  element  in  the  chain  that  led  to  the  failure  of 
the  commercial  aircraft  mentioned  earlier  was  a  failed  bond.  The  failed  bond  resulted  from  an  inadequate  bonding 
process.  It  created  stress  risers  at  the  rivets,  which  were  designed  to  merely  serve  as  secondary  conduits  for  transferring 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 


12-2 


load.  The  resulting  fatigue  cracks  were  aggravated  by  loss  of  material  due  to  corrosion,  resulting  in  intrusion  of  moisture 
from  condensation  and  precipitation.  Such  problems  that  are  encountered  in  service  must  be  quickly  corrected  in  order  to 
prevent  accidents  and  to  maintain  battle-readiness  of  the  fleet.  An  essential  requirement  for  quick  resolution  of  these  type 
of  problems  is  a  technical  team  that  is  familiar  with  not  only  the  design  features  of  the  aircraft  model  and  any  subsequent 
modifications  that  had  been  effected  previously  but  also  the  original  design  philosophy  that  guided  the  design.  Often,  it  is 
beneficial  to  retain  some  members  of  the  original  design  team  to  serve  in  the  maintenance  group  in  order  to  maintain  the 
necessary  know-how. 

Measurement  of  Safety 

In  order  to  assess  safety  of  a  system  after  it  enters  service  one  must  define  safety  and  establish  a  set  of  metrics 
(measurement  standards)  for  safety.  A  metric  may  be  the  number  of  failures  per  one  thousand  operations,  or  it  may  be  an 
incident  rate  or  an  accident  rate.  Such  gross  metrics  are  normally  refined  by  dividing  the  accidents  into  categories  by 
causal  relationships.  Furthermore,  metrics  are  often  normalized  in  terms  of  usage.  In  any  event,  the  establishment  of 
safety  metrics  has  been  subjective,  to  say  the  least,  and  a  bit  disorganized  from  the  standpoint  of  relating  the  accident 
cause,  the  events  leading  up  to  the  accident,  and  the  design  fix.  The  problem  is  best  illustrated  through  Figure  1,  and  2. 
Both  figures  have  been  extracted  from  publicly  released  Boeing  Airplane  Company  documents  [2,  3].  They  depict  the 
relative  risk  of  an  accident  as  a  function  of  the  phase  of  flight,  based  on  historical  data.  Clearly,  if  miles  flown  is  chosen 
as  the  normalizing  factor  for  a  safety  metric,  the  metric  chosen  ignores  the  fact  that  risks  between  destinations  involving 
multiple  flight  legs  and  the  risk  involved  for  a  single  leg,  for  the  same  distance  traveled,  are  unequal  -  hence,  the  metric 
would  be  inappropriate.  Similarly,  in  the  assessment  of  military  aircraft,  the  hours  of  operation  is  usually  chosen  as  the 
normalizing  factor  but  such  a  choice  ignores  the  fact  that  the  mission  profiles  could  be  vastly  different,  even  for  the  same 
aircraft  model  but  used  in  different  squadrons.  Thus,  the  establishment  of  multiple  metrics  for  risk  using  the  same 
database  increases  the  opportunity  for  establishing  a  correlation  between  data  and  risk,  thereby  making  the  safety 
management  system  more  robust. 


Figure  1. 


Accidents  and  Onboard  Fatalities  by  Phase  of  Flight 

HliJI  Lo$s  and/or  Fatal  Accidents  —  Worldwide  Commercial  Jet  Fleet  — 1938  through  1997 
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Figure  2. 


PHASE  OF  OPERATION  OVERVIEW 

COMMERCIAL  JET  TRANSPORT  AIRCRAFT 
LAST  FIVE  YEARS 
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Accidents  and  the  Role  of  Precursors: 

It  is  generally  agreed  that  there  exist  certain  precursors  to  each  accident  and  incident.  If  one  of  these  precursors 
is  not  recognized  and  the  underlying  condition  that  has  caused  it  is  not  corrected  in  time,  then  it  can  graduate  into  an 
incident  or  even  an  accident.  Aircraft  are  highly  engineered  systems,  endowed  with  redundancies  and  fail-safe  features. 
They  are  "noisy”  systems.  That  is,  they  can  give  so  many  indications,  of  which  only  a  few  are  precursors,  that  one  can 
easily  be  lulled  into  complacency.  Fail  safety  embraces  two  concepts.  One  is  the  concept  that  the  first  failure  does  not 
impair  functionality  of  the  system.  The  second  is  that  the  first  failure  must  be  obvious  to  the  extent  that  it  will,  in  all 
likelihood,  be  detected  well  before  the  onset  of  subsequent  failures,  which  may  endanger  the  safety  of  the  system.  Thus, 
the  first  occurrence  of  a  service  difficulty  associated  with  a  sub-system  in  an  aircraft  is  a  prospective  precursor  of 
progressive  failures  that  could  result  in  an  incident  or  accident.  Furthermore,  multiple  occurrences  of  service  difficulties, 
especially  after  corrective  actions  have  been  attempted,  are  indicators  that  the  risk  of  an  incident  or  accident  is  rising.  To 
take  full  advantage  of  being  given  such  warnings,  the  organization  responsible  for  safe  operation  of  the  aircraft  must 
systematically  collect  reports  of  service  difficulties.  Just  as  importantly,  this  same  organization  must  systematically  and 
expeditiously  analyze  the  reports  being  collected  to  establish  their  root  cause  of  the  difficulty  or  difficulties  and  its 
potential  for  a  resulting  accident  or  incident.  The  analysis  must  be  accomplished  early  in  order  to  allow  sufficient  lead- 
time  for  corrective  action  to  be  taken.  Even  with  a  service  difficulty  collection  and  analysis  system  in  place,  the 
organization  will  be  unable  to  use  it  to  reduce  or  eliminate  incidents  and  accidents  unless  higher  management  in  the 
organization  recognizes  their  value  and  directs  development  and  implementation  of  corrective  action.  Clearly,  improved 
safety  will  result  if  attention  is  more  focused  on  precursors. 
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Detection  of  Service  Difficulty 

A  Service  Difficulty  is  symptomatically  manifested  by  one  of  the  following: 

Visual,  such  as  cracks,  warning  lights,  observation  of  smoke,  etc. 

Aural,  such  as  alarms,  abnormal  sounds,  etc. 

Tactile,  such  as  excessive  vibration,  electrical  shock,  stick  response,  etc. 

Olfactory,  such  as  fumes  from  electrical  systems  or  oil  or  rubber,  etc. 

Response  to  transducer  devices  such  as  those  used  for  nondestructive  inspection  of  structural  components. 

Service  difficulties  can  manifest  themselves  during  airworthiness  inspections  and  other  maintenance  related 
activities.  One  example  is  the  detection  of  a  structural  fatigue  crack  in  an  area  adjacent  to  the  area  being  inspected.  The 
maintenance  program  had  no  instructions  for  inspecting  this  cracked  area.  Had  the  service  difficulty  report  not  been  filed 
on  this  crack,  and  had  a  single  observant  authority  representative  not  discovered  this  difficulty  report  and  investigated  it , 
further  crack  growth  in  this  area  and  other  aircraft  might  have  occurred  and  graduated  into  something  serious. 

It  would  be  erroneous,  however,  to  draw  a  correlation  between  the  number  of  service  difficulty  reports  generated 
and  risk.  A  large  number  of  reports  may  mean  that  the  operational  and  maintenance  personnel  are  alert  and  diligent  in 
reporting  discrepancies,  not  necessarily  that  the  risk  of  failure  is  rising.  In  this  case,  it  may  simply  be  a  tribute  to  the 
robustness  of  the  inspection  and  maintenance  program.  Only  systematic  analysis  performed  by  trained  and 
knowledgeable  analysts  can  correlate  the  risk  level  to  the  number  of  service  difficulty  reporting  rates. 

Analysis  and  Data  Requirements 

There  is  a  symbiotic  relationship  between:  (a)  the  purpose  of  safety  analysis,  (b)  the  methodology  to  be  used  for 
evaluating  safety  (or  risk),  (c)  the  data  required  to  perform  safety  analysis,  (d)  the  confidence  to  be  reposed  in  the  results, 
(e)  and  the  burden  of  the  data  collection  effort.  All  five  aspects  will  have  to  be  considered  in  concert  to  devise  a  robust 
system  that  balances  system  costs  (figure  3). 

Figure  3.  Elements  Associated  With  Service  Difficulty  Related  Activities 


71 


Define 

Requirements 


Validate 

Requirements 

T 

Analyze 

Data 


Collect 

Data 

4 

Store  &  Retrieve 
Data 


Ensure  Data 

Quality  Standards 


Safety  analysis  may  be  required  for  a  variety  of  purposes.  For  instance,  to  gage  the  general  health  or  safety  of 
the  fleet  would  require  a  different  methodology  and  could  be  accomplished  with  an  abbreviated  set  of  data  elements  than 
what  might  be  needed  for  a  forensic  analysis  of  an  accident  or  incident.  Thus,  the  circulation  of  a  questionnaire  among 
the  various  groups  involved  in  maintaining  safety  to  establish  the  connections  between  analysis  methodologies  that  are 
being  used  or  desired,  and  the  respective  data  requirements  is  advocated. 

Aircraft  systems  are  becoming  more  and  more  complex,  placing  more  sophisticated  demands  on  data  collection 
and  analysis  methods.  Also,  the  increased  attention  being  given  to  safety  and  the  accompanying  demand  for  data  driven 
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safety  programs,  makes  the  data  elements  that  would  have  been  considered  adequate  in  the  past  appear  as  lacking  in 
precision  and  detail.  Thus,  the  number  of  data  elements,  the  extent  of  detail  to  be  included  in  any  gathering  effort,  and  the 
configuration  of  the  database  itself  should  be  designed  to  allow  for  some  growth  in  data  requirements.  It  is  imperative 
that  an  organization  designing  a  service  difficulty  reporting  system  that  mandates  the  collection  of  certain  data  elements 
simultaneously  considers  the  analysis  to  be  conducted  of  the  collected  data.  Many  existing  databases,  such  as  the  Service 
Difficulty  Reports  being  maintained  by  the  Federal  Aviation  Administration  have  come  in  for  criticism  [4,  5].  These 
databases  collect  many  pieces  of  data  that  are  not  used  or  are  redundant.  Such  databases  are  primarily  designed  to 
facilitate  the  collection  of  data  but  with  little  or  no  attention  being  paid  to  the  needs  of  the  analyst  to  correlate  the  data 
with  the  airworthiness  of  the  individual  aircraft  or  the  fleet.  Hence,  it  is  advocated  that  a  safety  program  -  any  safety 
program  -  be  revisited,  perhaps  re-tuned,  every  five  years,  both  from  the  viewpoint  of  currency  and  adequacy. 

Avionics-related  malfunctions  may  have  serious  implications  in  terms  of  safety  of  new  generation  aircraft. 
These  systems  are  being  given  more  authority  over  primary  flight  control  of  the  aircraft.  Thus,  the  reporting  of  associated 
malfunctions,  defects,  and  failures  become  more  critical  to  proactive  safety  analysis.  Their  failures  during  any  phase  of 
operation  may  have  safety  implications.  In  any  event,  data  should  be  collected  to  support  explicit  program  requirements. 
Terminology  such  as  “abnormal  or  emergency  actions”  and  “endanger  the  safe  operation”  in  regulations  will  not  provide 
consistent  reporting  without  further  definition  and  guidance. 

The  distinction  between  reliability  and  safety  is  much  debated  in  the  context  of  data  requirements.  It  has  been 
argued  the  data  needed  for  performing  safety  analysis  is  not  as  extensive  as  that  for  maintaining  reliability.  However, 
with  the  emergence  of  the  nearly  synonymous  philosophies  of  Reliability-Based  Maintenance  and  Condition-Based 
Maintenance,  which  takes  the  risk  of  failure(s)  into  account,  the  distinction  is  blurring. 

Hand-held  electronic  devices  have  eliminated  much  of  the  paperwork  in  data  gathering.  Such  devices  make 
possible  the  gathering  of  voluminous  data  without  making  the  data  gathering  effort  either  burdensome  or  time  consuming. 
In  fact,  the  development  of  software  that  can  readily  depict  on  a  hand-held  device  the  geometrical  layout  of  components 
as  well  as  the  inter-connectivity  of  the  functional  units  would  make  facilitate  acquisition  of  data  that  capture  more  details 
about  a  malfunction  or  a  failure  than  is  now  the  case.  Electronic  entry  of  data  has  another  great  advantage,  viz.,  it  avoids 
data  corruption  due  to  transcription  errors  and  expedites  the  addition  of  more  data  elements  to  the  database. 

Data  Standards 


The  term  ’’data  quality”  can  at  once  mean  different  things,  such  as  erroneous  data,  inconsistencies  in  the  data, 
insufficient  detail  that  has  been  captured  in  the  data,  completeness  of  the  data  sets,  etc.  Each  of  the  meanings  has  a 
bearing  on  safety.  For  instance,  there  is  a  wealth  of  data  about  instances  of  cracking  in  airframe  structures  but  they  are 
not  very  useful  because  of  lack  of  precision  and  standardization.  From  the  standpoint  of  systematic  analysis  of  large 
quantities  of  data,  the  most  important  attribute  of  a  safety  related  database  is  consistent  reporting.  The  adoption  of  a 
common  terminology  is  one  aspect  of  consistency.  Clarity  of  terminology  is  a  related  aspect.  A  critical  need  for  data  that 
is  stored  in  relational  databases  is  that  fields  should  be  assigned  in  each  data  record  (report)  to  allow  for  supplementary 
comments  by  the  mechanic.  The  FAA  maintains  one  of  the  largest  safety  database  in  the  world,  the  Service  Difficulty 
Reporting  (SDR)  System.  However,  because  the  SDR  is  a  relational  database,  no  provision  has  been  made  for 
supplementary  notes.  For  instance,  the  database  does  not  allow  the  mechanic  to  record  the  specific  location  of  a  crack, 
even  if  one  is  found  in  a  principal  structural  element.  As  a  result,  many  users  rely  on  the  SDR  system  only  to  confirm 
critical  problems  that  have  already  been  found  or  suspected  -  not  to  give  precursory  evidence  of  potential  incidents  or 
accidents. 

.  Table  1  exemplifies  a  form  for  data  recording,  which  would  make  possible  supplementary  notes  to  be  made  by  the 
mechanic  or  inspector.  The  form  for  reporting  incidents  was  drafted  by  an  internal  FAA  team,  of  which  the  author  was  a 
member.  The  data  requirements  for  reporting  service  difficulty  can  be  developed  in  an  analogous  fashion. 
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TABLE  1:  EXAMPLE  OF  A  FORM  FOR  RECORDING  AN  INCIDENT 

BATCH  #  I.D.  # 


REV. 

DATE 

0 

/ 

/ 

1 

/ 

/ 

2 

/ 

/ 

3 

/ 

/ 

EVENT  ID  NUMBER: 
/  /  / 

YY  MM  DD  SE 


ANALYST 


REVIEWER 


TIME  OF  EVENT:  (SELECT  ONE) 

UNKNOWN  _ 

UT  _ 

LOCAL  TIME 


EVENT  CLASSIFICATION: 

HAZARDOUS _ 

MAJOR _ 

MINOR _ 

DAMAGE 


LOCATION: 

DEPARTURE  AIRPORT_ 
DESTINATION  AIRPORT 

EVENT  LOC.  (CITY)  _ 

COUNTRY  (EVENT)  _ 

LAT/LONG _ 

UNKNOWN 


AIRCRAFT: 

TYPE-SERIES _ 

A/C  MAKE _ 

FUSELAGE  NO. _ 

DATE  MANUFACTURED _ 

TAIL  NUMBER _ 

SERIAL  NUMBER _ 

ENGINE  MAKE _ 

ENGINE  MODEL(S) _ 

ENGINE  SERIAL  NO(S). _ 

FLIGHT  NUMBER _ 

METEOROLOGICAL/ENVIRONMENT 

IMC/VMC _ 

CLOUD  CEILING  FT  OR  M _ 

LIGHT  CONDITIONS 

DAY/NIGHT/DUSK/DAWN _ 

VISIBILITY  FT,  M,  MI _ 

WIND:  DIRECTION _ 

VELOCITY  IN  KTS _ 

TEMPERATURE  F  OR  C _ 

MICROBURST _ 

CAT _ 

WINDSHEAR 


TYPE  OF  MISSION:  (SELECT  UP  TO  2) 
SCHEDULED  PAX  CARGO 

UNSCHEDULED  PAX  FERRY 

FLIGHT  TEST  TRAINING 

UNKNOWN 
MAINT 

AIRLINE/OPERATOR: 

OPERATOR  NAME _ 

OPERATOR  OAG  CODE 


VERTICAL  TURBULENCE 

HAZE _ 

HAIL _ 

BIRDS _ 

SNOW/SLUSH _ 

SAND/ASH _ 

THUN  STRMS _ 

LIGHTNING _ 

OTHER  WEATHER _ 

ICE/RAIN/FOG/GUSTS 


BOARDING 
CARGO  LOADING 
ENGINE  START 
TAXI 

TAKE  OFF 
ROLL 
ROTATION 
INIT  CLIMB 
GO  AROUND 
DURING  DIVERT 


PHASE  OF  OPERATION 
DESCENT 
APPROACH 
INITIAL 
FINAL 
LANDING 

FLARE  &  TOUCHDOWN 
ROLL 

TOUCH  AND  GO 
CRUISE 


DEBOARDING 

PARKED 

REFUELING 

INSPECTION 

TOWED 

SERVICING 

UNKNOWN 

CLIMB  TO  CRUIS 

TAXI 
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HARDWARE  INVOLVED  IN  INCIDENT:  ATA  CODE 

NAME  _ 

_  _  MODEL  _ 

_  _  MAKE  _ 

_  _  LOCATION _ 

_  _  PART  NUMBER _ 

_  _  TOTAL  TIME _ 

TIME  SINCE  O/H _ 

CYCLES  SINCE  O/H 
TOTAL  CYCLES 


TYPE  OF  HUMAN  MACHINE  INTERFACE  ERROR 
Suggest  that  a  coded  list  be  developed  that  is  similar  to  ATA  codes 

NAT.  AVIATION  SYSTEM  (NAS):  TBD 


FLIGHT  CREW  EXPERIENCE: 

CAPTAIN _ 

TIME  IN  TYPE  ACFT _ 

FIRST  OFFICER 

TIME  IN  TYPE  ACFT _ 

SECOND  OFFICER 
TIME  IN  TYPE  ACFT 


PILOT  IN  COMMAND 
TOTAL  FLYING  TIME 

TOTAL  FLYING  TIME 

TOTAL  FLYING  TIME 


FLIGHT  CREW _ 

MAINTENANCE _ 

OPERATOR _ 

MANUFACTURER 

NTSB _ 

WAAS 


DATA  SOURCES: 

ATC _ 

CAA _ 

FLT  INT _ 

FLIGHT  SAFETY  FOUNDATION 

NEWS _ 

AIRCLAIMS _ 

OTHER 


BRIEF  DESCRIPTION:  _ 

Describe  the  event/situation.  Keeping  in  mind  the  following  topics,  discuss  those  which  you  feel  are  relevant  and 
anything  else  you  think  is  important.  Include  what  you  believe  really  caused  the  problem,  and  what  can  be  done  to 
prevent  a  recurrence,  or  correct  the  situation.  (USE  ADDITIONAL  PAGES  IF  NECESSARY) 

1.  CHAIN  OF  EVENTS  2.  HUMAN  PERFORMANCE  CONSIDERATIONS 

Perceptions,  judgements,  decisions 
Factors  affecting  the  quality  of  human  performance 
Actions  or  inactions 
Lack  of  positional  awareness 
Lack  of  awareness  of  circumstances 
of  flight 

Incorrect  selection  on  instrument/navaid 
Action  on  wrong  control/instrument 
Slow/delayed  action 
Omission  of  action/inappropriate  action 
Fatigue 
State  of  mind 

Lack  of  qualification/training/experience 
Incapacitation/medical  or  other  factors 
reducing  crew  performance 
Deliberate  non-adherence  to  procedures 
FULL  NARRATIVE:  _ 

ANALYST  COMMENTS:  _ 

Factors  Relevant  to  Incident 

(Each  incident  usually  has  more  than  one  factor) 


How  the  problem  arose 
Contributing  factors 
How  was  it  discovered 
Corrective  actions  taken 
System  configurations  and 
operating  modes 
What  procedures  were  used 
How  did  you  decide  what  to  do 
What  stopped  the  incident  from 
becoming  an  accident 
Failure  in  Cockpit  Resource 
Management  Fatigue 
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Group  Factor  No.  acc. 

A. _ Causal  factors _ _ _ 

A.  1  Aircraft  systems  1 . 1  System  failure  -  affecting  controllability 

1 .2  System  failure  -  flight  deck  information 

_ 1 .3  System  failure  -  other _ 

A.2  ATC/Ground  aids  2.1  Incorrect  or  inadequate  instruction/advice 

2.2  Misunderstood/missed  communication 

2.3  Failure  to  provide  separation  -  air 

2.4  Failure  to  provide  separation  -  ground 

_ 2.5  Ground  aid  malfunction  or  unavailability _ 
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Group  Factor  No.  acc. 


A _ Causal  factors 


A.  8  Structure 

8.1  Corrosion/fatigue 

8.2  Overload  failure 

8.3  Flutter 

A.  9  Infrastructure 

9. 1  Incorrect,  inadequate  or  misleading  information  to  crew 

9.2  Inadequate  airport  support 

A.  10  Design 

10.1  Design  shortcomings 

10.2  Unapproved  modification 

10.3  Manufacturing  defect 

A.  11  Performance 

11.1  Unable  to  maintain  speed/height 

11.2  Aircraft  becomes  uncontrollable 

A.  12  Other 

12.1  Caused  by  other  aircraft 

12.2  Non-adherence  to  cabin  safety  procedures 

B _ Circumstantial  factors 


B.l  Aircraft  systems 

1 . 1  Non-fitment  of  presently  available  safety  equipment 
(GPWS,  TCAS,  windshear  warning,  etc.) 

1.2  Failure/inadequacy  of  safety  equipment 

B.2  ATC/ground  aids 

2.1  Lack  of  ATC 

2.2  Lack  of  ground  aids 

B.3  Environmental 

3.1  Poor  visibility 

3.2  Other  weather 

3.3  Runaway  condition  (ice,  slippery,  standing  water,  etc.) 

B.4  Training 

4.1  Training  inadequate 

4.2  Presented  with  situation  beyond  training 

4.3  Failure  in  CRM  (cross-check/co-ordinate) 

B.5  Infrastructure 

5 . 1  Incorrect/inadequate  procedures 

5.2  Company  management  failure 

5 . 3  Inadequate  regulation 

5.4  Inadequate  regulatory  oversight 

C _ Consequences _ 

C.  1  Controlled  flight  Into  Terrain  (CFIT) 

C.2  Collision  with  terrain/water/obstacle 

C.3  Mid-air  collision 

C.4  Ground  collision  with  other  aircraft 

C.5  Ground  collision  with  object/obstacle 

C.6  Loss  of  control  in  flight 

C.7  Fuel  exhaustion 

C.8  Overrun 

C.9  Undershoot 

C .  1 0  Structural  failure 

C.ll  Post  crash  fire 

C .  1 2  F ire/smoke  during  operation 

C .  1 3  Emergency  evacuation  difficulties 

C.  14  Forced  landing  -  land  or  water 

C.  1 5  Other  cause  of  fatality _ 


D  Unknown 


Level  of  confidence  _  High  _  Medium  _ Low  _ Insufficient 

Information 


Note:  Acts  of  terrorism  and  sabotage,  test  and  military-type  operations,  and  fatalities  to  third  parties  not  caused  by  the 
aircraft  or  its  operation  are  excluded. 
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In  the  military  context,  harmonization  of  data  standards  with  our  NATO  allies  will  inevitably  result  in  more 
robust  safety  systems  for  all  concerned.  Also,  since  the  occurrences  of  many  types  of  malfunctions  are  rare, 
harmonization  will  allow  data  to  be  shared  between  nations  that  operate  similar  aircraft  systems  and  increase  the  data 
pool,  thereby  decreasing  uncertainty  inherent  in  statistics-based  analysis  schemes. 

Completeness  of  data,  whether  the  entry  relates  to  deviation,  malfunction,  or  wear  is  nearly  as  important.  The 
need  to  report  and  record  every  deviation  from  the  norm,  even  though  the  vast  majority  of  cases  are  benign,  cannot  be 
over-emphasized.  It  is  also  essential  for  the  analyst  (or  analysis  group)  to  promptly  acknowledge  receipt  of  each  report 
and,  once  the  analysis  of  a  report  is  complete,  to  communicate  the  results  to  the  maintenance  group.  Otherwise,  the  latter 
group  may  lose  faith  in  the  system. 

Data  Archival  and  Retrieval 


An  efficient  database  storage  system  has  to  take  into  account  several  factors.  Simultaneous  access  to  multiple 
users  may  be  one  requirement.  Inclusion  of  pictures,  and  documents  in  the  database  may  be  another.  There  are  several 
ways  to  store  and  present  data  and  several  types  of  database  management  systems  (DBMS)  have  been  devised  and  are 
commercially  available.  In  choosing  the  right  type  of  DBMS  it  is  important  to  consider  the  capability  of  a  typical  user 
and  the  purpose  underlying  the  use  of  the  data.  For  safety  analyses  purposes,  the  DBMS  should  be  capable  of  storing  and 
manipulating  complex  objects  and  data  types  efficiently.  The  most  suitable  type  and  currently  available  DBMS  are  the 
ones  known  as  object-oriented  DBMS.  Such  relational  databases  allow  for  computer-aided  searches  and  sorts  that  are 
simple  to  implement  ,  allowing  the  user  to  concentrate  on  deriving  the  information  he  or  she  is  seeking  rather  than 
focusing  on  the  design  of  the  database  extraction  tool.  On  the  other  hand,  if  one  is  willing  to  invest  in  more  complex 
search  engines,  the  database  may  need  to  be  less  structured  and  therefore  contain  much  more  information.  An 
explanation  of  the  various  types  of  DBMS  can  be  found  in  reference  [6].  Even  object-oriented  DBMS  have  their 
drawbacks  and,  thus,  the  entire  subject  deserves  research  attention. 

Analysis  Methods 

Service  difficulty  data  can  be  used  for  a  variety  of  purposes  and  in  a  variety  of  ways.  The  common  thread  that 
runs  through  all  of  them,  however,  is  risk  mitigation.  Obviously,  the  criticality  of  the  component  associated  with  the  data, 
the  number  of  incidences  of  failure,  the  consequences  of  failure,  the  method(s)  used  for  analysis,  the  confidence  band 
inherent  in  the  analysis  results,  and  the  statistical  character  of  the  occurrence  are  inextricably  related. 

Accidents  and,  to  a  lesser  extent,  incidents  and  malfunctions  typically  involve  a  chain  of  events.  The  chain  may 
simultaneously  involve  a  design  deficiency,  a  defect  induced  during  the  manufacturing  process,  improper  maintenance  or 
other  human  factors.  Some  aspects  that  are  frequently  involved  are  given  in  Table  2. 


TABLE  2:  ASPECTS  THAT  CAN  ADVERSELY  AFFECT  SAFETY 


Design 

New  Technology 
Repair 

Flight  Operations 

Software 

Regulations 

Hazardous  Cargo/Stores 


Manufacturing 
Technological  Obsolescence 
Unwitting  Exceedances 
Air  Traffic  Control 
Training 

Environmental  Rules 


Maintenance 
Human  Factors 
Configuration  Management 
Adverse  Environment 
Records 

Unapproved  Parts 


It  has  been  argued  that,  since  many  factors  are  involved  in  causing  an  incident  or  accident,  the  safety 
management  system  should  be  highly  centralized.  The  author  would  argue  in  favor  of  the  opposite,  mainly  because  the 
safety  system  would  be  redundant  and,  hence,  more  robust.  The  responsibility  for  safety  should  be  divided  into  sub¬ 
groups,  whose  prime  responsibilities  are  related  to  maintenance  or  air  traffic  control  or  some  other  factor  identified  in  the 
table.  Each  group  should  be  persuaded  to  believe  that  they  are  ultimately  responsible  for  safety  and  each  group  should  be 
allowed  to  devise  their  own  system  for  monitoring  risk.  Of  course,  each  such  group  will  be  much  better  versed  in  their 
own  specialty  and  might  tend  to  give  greater  attention  to  it.  On  the  other  hand,  it  can  be  argued  that  they  will  tend  to  take 
less  for  granted  in  other  specialty  areas  and  therefore  subject  them  to  greater  scrutiny. 

If  the  aforementioned  view  is  accepted,  it  would  follow  that  each  group  will  have  different  data  requirements. 
The  latter  can  be  fulfilled  with  relative  ease  by  customizing  data,  but  which  is  drawn  from  the  same  master  data  pool. 
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One  example  of  an  extensive  and  well-disciplined  service  difficulty  reporting  and  collection  system,  as  has  been 
previously  mentioned,  is  that  being  maintained  by  the  FAA.  Unfortunately,  the  FAA  does  not  have  the  means  to 
systematically  analyze  the  data  reported,  which  purportedly  is  not  all-inclusive.  Instead,  it  does  so  in  an  ad-hoc  manner. 
That  is,  it  researches  the  database  to  seek  service  difficulties  that  indicate  the  pervasiveness  of  a  fault  in  the  aircraft  fleet. 
Such  searches  are  carried  out  after  the  problem  has  been  brought  to  the  attention  of  the  authority  through  other  means, 
such  as  an  incident  or  an  accident.  However,  the  efforts  of  the  FAA  are  a  valuable  adjunct  to  the  safety  analysis  efforts  by 
industry.  Moreover,  the  SDR  database  is  accessible  to  other  users,  such  as  aircraft  manufacturers  and  operators,  who, 
because  of  their  focus  tend  to  be  more  systematic  in  the  analysis  of  the  data. 

Causal  Analysis 

Causal  analysis  of  an  accident  or  incident  seeks  to  establish  those  factors  that  were  judged  to  be  directly 
responsible  in  causing  the  event  (primary  causal  factors)  and  those  that  contributed  to  the  event  (secondary  causal  factors) 
by  deconstructing  the  accident.  For  these  causal  factors,  a  causal  chain  can  usually  be  established  for  each  accident  or 
incident  [7].  The  advantage  of  causal  chain  analysis  is  that  in  the  case  of  multiple  causes  and  multiple  accidents  or 
incidents,  the  common  events  or  elements  in  the  chain  can  be  identified  and  subjected  to  greatest  attention.  Thus,  the 
safety  system  can  concentrate  on  those  common  events  and  maximize  its  responsiveness  and  effectiveness  in  for  cutting 
down-times,  and  reducing  or  eliminating  accidents.  The  perceived  disadvantage  of  this  approach  is  that  it  is  reactive 
rather  than  proactive.  That  is,  the  regulating  authority  and  the  industry  (or  the  military  operators)  seek  to  eliminate  the 
causal  factor  after  the  accident  in  order  to  prevent  accidents  due  to  the  same  cause  from  happening  again. 

Causal  analysis  does  have  an  advantage  over  simulation  and  technical  conjecture  in  that  it  is  based  on  factual 
data  rather  than  models  that  mimic  a  hypothetical  event  or  engineering  judgement,  which  relies  on  the  knowledge  base 
and  experience  of  the  technical  team.  Moreover,  as  has  already  been  mentioned,  in  today's  aviation  industry,  it  is  difficult 
to  retain  an  engineering  team  that  is  intimately  familiar  with  the  continuous  changes  in  the  aircraft  design  after  production 
begins. 


The  causal  analysis  approach,  however,  also  suffers  from  the  disadvantage  that  the  analysis  has  a  good  measure 
of  subjectivity,  both  in  regard  to  the  list  of  factors  and  their  relative  contributions.  Also,  due  to  the  inter-dependencies  of 
the  various  factors,  such  as  those  listed  in  Table  2,  that  are  frequently  encountered,  the  relative  weights  ascribed  to  the 
various  causal  factors  can  vary  a  great  deal,  as  a  function  of  the  analyst.  Thus,  an  intimate  knowledge  of  the  aircraft 
system  is  a  prerequisite  for  someone  engaging  in  causal  analysis.  The  challenge  of  managing  aircraft  safety  is  identify 
and  focus  on  truly  hazardous  conditions,  so  they  can  be  eliminated  before  a  potential  accident  becomes  a  reality. 

Trend  Analysis 

One  simple  and  effective  method  is  used  in  the  Aviation  Safety  for  Accident  Prevention  (ASAP)  program  that  is 
used  by  the  FAA's  Rotorcraft  Directorate  in  Ft.  Worth,  Texas.  The  program  selects  components  that  fail  by  part  numbers. 
For  each  part,  it  reviews  the  service  history  for  3,  6,  12  or  24  months  periods.  Based  on  the  counts  of  service  difficulty 
reports  involving  the  part  number,  it  predicts  trends. 

A  risk  level  is  assigned  to  each  report.  ASAP  has  the  ability  to  quickly  research  whether  an  accident  had  a 
service  difficulty  history.  For  example,  responding  to  a  fatal  accident  involving  the  tail  rotor  driveshaft,  the  analyst  was 
able  to  track  part  numbers,  and  identify  five  service  difficulty  reports  that  had  found  the  part  to  have  been  worn  beyond 
limits,  and  contained  cracks  or  corrosion.  Two  of  the  reports  described  the  results  of  inspection  to  be  a  sheared  tail  rotor 
driveshaft.  Based  on  the  accident  and  the  supporting  trend  indicated  by  the  service  history,  the  Authority  issued  an 
Airworthiness  Directive  (AD).  A  year  after  the  issuance  of  the  AD  there  were  no  more  service  difficulty  reports,  citing 
that  particular  part  was  reported.  But,  more  importantly,  the  incidence  of  sheared  rotor  drive  shafts  has  been  drastically 
reduced.  However,  ASAP  has  one  drawback:  usage  of  ASAP  is  not  yet  proactive  in  that  the  analyst  must  be  prompted 
by  an  event,  such  as  an  accident  or  incident  to  conduct  trend  analysis  on  a  given  part  or  component. 

Monitoring  of  Safety  Through  Performance  Indicators 

The  FAA's  Flight  Standards  Service  has  developed  a  heuristic-based  system  called  Safety  Performance  Analysis  System 
(SPAS),  primarily  for  the  benefit  of  their  corps  of  safety  inspectors.  They  started  building  the  system  by  getting  teams  of 
highly  experienced  and  proficient  inspectors  together,  with  each  inspector  identifying  the  parameters  that  he  or  she  uses 
during  surveillance  of  an  operator  or  a  repair  station  facility.  Each  team  discussed  each  of  the  identified  parameters  and 
developed  a  consensus  about  the  relative  importance  of  the  parameters  that  must  be  scrutinized.  Next,  the  parameters 
were  weighted  according  to  their  perceived  importance  and  aggregated  into  groups,  with  each  group  being  termed  as  an 
"indicator."  The  advantage  of  a  system  that  is  based  on  indicators  is  that  pools  the  knowledge  and  experience  of  the  "gray 
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beards”  or  the  more  experienced  inspectors  in  the  regulating  Authority  for  use  by  the  younger,  less-experienced 
inspectors.  Hence,  it  focuses  attention  on  what  is  a  warning  rather  than  on  events  that  are  merely  ’’noises.”  The 
disadvantage  is  that  a  rational  derivation  of  threshold  values,  which  signal  caution  or  even  danger,  is  not  possible. 

A  variation  of  the  idea  of  performance  indicators  as  measures  of  safety  is  proposed  by  the  author.  It  is  based  on 
’’wiring  diagrams”  of  sub-systems  being  used  in  conjunction  with  the  concept  of  indicators.  In  the  pristine  condition, 
every  cell  in  the  wiring  diagram  would  be  colored  white.  When  a  failure  of  a  certain  part  occurs,  the  analyst  assesses  the 
criticality  of  the  part  to  flight  safety  and  assigns  a  hue  to  that  part  (cell)  in  the  wiring  diagram.  A  deeper  hue  or  color 
would  signify  that  the  part  has  a  relatively  high  criticality.  The  wiring  diagram  is  constantly  updated  by  adding  more 
color  to  the  particular  part  to  reflect  arrival  of  new  service  difficulty  reports.  Two  events  will  attract  the  attention  of  the 
analyst.  The  first  is  the  depth  of  the  hue  of  a  certain  cell  and  the  second  is  the  contiguity  of  cells  (the  ones  that  are 
sequentially  tied  or  represent  the  redundant  feature),  in  terms  of  their  function,  that  are  hued.  The  idea  is  based  on  the 
recognition  of  the  fact  that  in  both  cases  the  risk  of  sub-system  failure  is  increasing,  and  that  the  wiring  diagram 
pictorially  represents  the  rise.  In  fact,  it  would  be  relatively  easy  to  convert  the  logic  into  a  computer  code  that 
automatically  raises  a  flag  in  either  case,  which  cannot  escape  the  attention  of  the  analyst.  Also,  different  colored  flags 
may  be  set  up  to  indicate  the  level  of  alert.  The  scheme  will  also  need  to  take  into  account  replacement  or  re-design  of  the 
part,  or  the  sub-assembly  itself.  That  is  also  easily  done  by  washing  out  the  color  in  the  particular  cell  representing  the 
part  or  in  the  block  of  cells  if  the  sub-assembly  has  been  redesigned  or  refurbished 

Probabilistic  Risk  Analysis 

Several  probabilistic  approaches  to  safety  have  been  proposed  [8}.  However,  such  approaches  are  not  looked 
upon  with  enthusiasm  because  no  one  wants  to  look  upon  safety  management  in  a  manner  that  resembles  a  game  of 
chance.  However,  there  are  at  least  two  major  advantages  of  a  probabilistic  approach.  First,  it  takes  into  account  the 
variability  in  the  data  as  well  as  the  trends  in  the  number  of  occurrences.  It  also  provides  for  considering  the  relationship 
between  seemingly  unrelated  occurrences.  The  analyst  must  examine  the  estimated  probability  of  an  accident,  given  a 
high  probability  of  the  occurrence  of  service  events,  and  determine  if  intervention  is  required.  A  unique  advantage  of  the 
probabilistic  approach  over  a  deterministic  approach  is  that  it  enables  the  Authority  or  the  Safety  Office  in  the  military  to 
focus  on  the  most  likely  causes  of  hypothetical,  future  accidents,  and  prevent  them.  By  far  the  most  important  advantage 
is  that  it  enables  the  Authority,  and  the  operators,  to  get  ahead  of  the  power  curve  -  that  is,  to  correct  the  condition  before 
the  first  accident  occurs. 

Concluding  Remarks 

As  new  technology  is  inducted,  aircraft  systems  will  inevitably  become  more  complex.  New  technology 
generally  means  better  performance  and  lower  costs  but  there  might  be  safety-related  challenges  as  well.  Also,  increased 
usage  and  operating  missions  beyond  what  was  envisaged  in  the  design  stage  will  magnify  the  accident  rate  as  well  as  the 
fatalities,  injuries,  or  losses  of  high-value  assets.  Safety  systems  will  need  to  be  more  sophisticated  and  better  methods 
of  analysis  will  need  to  be  employed.  Authorities,  and  in  the  case  of  the  military  -  themselves,  will  need  to  focus  more  on 
preventing  accidents  due  to  service  related  events  rather  than  using  service  data  to  confirm  the  analysis  of  accidents  that 
have  already  happened. 

Concomitantly,  more  extensive  data  require- ments  and  data  archival  systems  will  need  to  be  engineered.  Thus, 
the  cost  of  maintaining  a  high  level  of  safety  is  bound  to  rise  but  the  cost  due  to  not  having  an  effective  system  will  be 
many  times  greater.  Safety  of  highly  engineered  systems,  like  aircraft,  has  a  high  price  tag  but  the  alternative  will  prove 
to  be  much,  much  more  expensive. 
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1.0  INTRODUCTION 

Throughout  the  world  military  and  commercial  aircraft  fleet  are  being  used  beyond  their  original  design  life. 
This  is  primarily  due  to  the  reduction  in  the  budget  for  procurement  of  new  systems  and  ever  increasing  cost  of 
acquiring  new  aircraft.  This  has  resulted  in  paying  more  attention  to  enhancing  life  of  aircraft  structures  and  at 
the  same  time  maintaining  the  safety  of  flight.  Improved  life  enhancement  techniques  and  repair  concept  are 
being  developed  to  keep  maintenance  cost  low,  reduce  down  time  of  aircraft  for  repairs,  reduce  inspection 
requirements  without  jeopardizing  the  safety  of  aircraft  structures. 

To  reduce  the  down  time  of  aircraft  for  repairs  and  perform  more  reliable  durability  and  damage  tolerance 
analyses,  a  number  of  software  programs  have  been  developed.  These  software  programs  are  user  friendly  and 
a  user  does  not  have  to  be  an  expert  in  the  repair  technology  or  durability  and  damage  tolerance  analyses.  For 
most  of  these  programs  basic  knowledge  of  stress  analyses,  fatigue  and  fracture  mechanics  is  required.  This 
tutorial  discusses  some  of  these  programs,  and  steps  involved  in  the  analyses  of  repairs  to  assure  safety  of 
flight. 

2.0  SOFTWARE  PROGRAMS  FOR  REPAIR  DESIGN,  AND  DURABILITY  AND  DAMAGE 
TOLERANCE  ANALYSES 

A  number  of  software  programs  have  been  developed  for  designing  repairs  for  aircraft  structures  and 
performing  durability  and  damage  tolerance  analyses.  These  programs  are  operational  on  a  personal  computer 
(PC).  Some  of  these  programs  are  briefly  described  here. 

1)  AFGROW 

This  code  has  been  developed  by  US  Air  Force  Wright  Patterson  Air  Force  Base  (WPAFB),  Ohio,  for 
durability  and  damage  tolerance  analyses  of  aircraft  structures  under  constant  amplitude  and  spectrum  loading. 
Code  has  capability  to  design  composite  patch  repairs  for  metallic  structures.  Crack  growth  life  predictions  can 
be  made  in  an  aggressive  environment  accounting  for  the  corrosive  effects  on  crack  growth.  The  code  is  user 
friendly  with  an  excellent  graphical  user  interface.  The  code  has  a  good  database  of  material  properties  needed 
for  damage  tolerance  analysis.  A  user  has  an  option  to  input  own  material  properties.  The  code  has  a  built  in 
library  of  stress  intensity  factors  for  a  number  of  crack  configurations  and  structural  geometries.  The  user  has 
an  option  to  input  own  stress  intensity  factors.  For  crack  growth  predictions  under  spectrum  loading,  the  user 
has  to  input  loads  spectrum.  The  code  takes  spectrum  in  a  certain  format.  Majority  of  airframe  manufacturers 
have  own  ways  of  generating  spectrum.  Hence,  a  translator  is  required  to  convert  input  spectrum  in  the  format 
used  by  the  code.  The  translator  varies  with  the  input  spectrum  format.  Translators  for  a  number  of  spectra 
formats  have  been  included  in  the  code.  If  a  user’s  spectrum  input  is  not  in  a  format  used  in  AFGROW  code, 
Mr.  Jim  Harter  at  WPAFB,  Ohio,  may  be  contacted  for  assistance  in  developing  a  translator. 

For  crack  growth  predictions  under  spectrum  loading,  a  number  of  retardation  models  have  been  included  in 
the  code.  Retardation  models  included  are- 

a)  Willenborg 

b)  Wheeler 

c)  Crack  Closure. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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The  retardation  parameters  needed  for  these  retardation  models  are  included  in  the  code  for  some  of  the 
materials.  A  user  has  option  to  input  own  retardation  parameters. 

The  code  has  capability  for  predicting  fatigue  life  under  spectrum  loading.  Strain-life  approach  has  been  used 
for  fatigue  life  predictions.  The  strain  life  approach  requires  cyclic  stress-strain  and  strain-life  data  for  the 
structural  material  of  interest.  The  cyclic  stress-strain  and  strain-life  data  for  some  materials  have  been 
included  in  the  code. 

This  code  has  capability  to  design  composite  patch  repairs.  A  knowledge-based  system  to  design  repairs  has 
been  developed  in  the  code.  The  code  recommends  the  most  suitable  material  for  composite  patch  design 
based  on  the  following  considerations- 

a)  Thickness  to  be  repaired. 

b)  Loads  spectrum  experienced  by  the  aircraft  component. 

c)  Stress  level  in  the  spectrum 

Repair  material  choices  available  are-  boron/epoxy,  graphite/epoxy,  and  GLARE.  The  properties  of  these 
materials  are  included  in  the  code.  The  code  recommends  ply  orientations  and  thickness  for  the  composite 
patch.  The  code  uses  damage  tolerance  approach  for  designing  repair  patches.  The  design  of  repair  patches  is 
based  on  using  ductile  adhesive  FM-73  for  bonding  process. 

2)  NASGRO 

This  user-friendly  program  has  been  developed  by  NASA  Johnson  Space  Center  and  is  available  in  public 
domain.  The  program  is  primarily  for  damage  tolerance  analyses  of  structures.  The  program  has  an  excellent 
database  for  material  properties  varying  from  aluminum  to  steel,  plate,  sheet,  forging,  etc. 

The  program  uses  boundary  element  technique  to  compute  stress  intensity  factors.  Crack  growth  predictions 
can  be  made  under  constant  amplitude  and  spectrum  loading.  The  program  does  not  have  capability  to  design 
repairs.  However,  it  is  a  very  useful  tool  for  the  damage  tolerance  analysis  of  structures  and  repairs. 

3)  RAPID 

This  program  has  been  developed  under  FAA  sponsorship  with  support  from  US  air  Force  and  is  primarily  for 
mechanically  fastened  repairs  of  transport  aircraft  (Reference  1).  The  program  has  an  excellent  Graphical  User 
Interface  (GUI).  The  program  is  available  in  public  domain.  The  program  is  not  suitable  for  damage  tolerance 
analysis  of  aircraft  structures.  The  program  has  capability  to  perform  repair  analysis  under  constant  amplitude 
as  well  as  spectrum  loading. 

The  program  has  an  excellent  database  for  material  and  fastener  properties.  The  program  is  suitable  for 
designing  three  different  types  of  repairs- 

1)  One  external  and  one  internal  doubler  (Figure  1). 

2)  Two  external  doublers  (Figure  2). 

3)  One  external  doubler  (Figure  3) 
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1  Outermost 
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Skin  Cutout 


Internal 
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‘  Outermost 
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Figure  1.  RAPID  Software-  One  Internal  and  One  External  Doubler  Repair 
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Figure  2.  RAPID  Software-  Two  External  Doublers  Repair 
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Skin  Cutout 


Figure  3.  RAPID  Software-  One  External  Doubler  Repair 


4)  RAPIDC 

RAPIDC  is  a  derivative  of  RAPID  program  developed  under  FAA  sponsorship.  The  program  has  been 
developed  primarily  for  mechanically  fastened  repairs  of  commuter  aircraft.  The  program  is  still  being  beta 
tested.  The  program  is  available  in  public  domain. 

5)  CalcuRep 

This  code  was  developed  by  Dr.  Rob  Fredell  during  his  stay  at  US  Air  Force  Academy  in  Colorado  (Reference 
2).  This  code  is  for  designing  bonded  repairs  for  fuselage  type  of  structures  subjected  to  internal  pressure 
loads.  The  code  is  available  in  public  domain  and  is  user  friendly.  The  code  is  primarily  useful  for  designing 
repairs  using  Glare  material. 

6)  FRANC2D 

This  is  a  finite  element  code  and  can  be  used  for  crack  growth  analysis  of  metallic  structures  (Reference  3) 
under  constant  amplitude  loading.  The  code  is  available  in  public  domain.  Finite  element  analysis  of  the 
structural  configuration  with  crack  is  carried  out  and  stresses  intensity  factors  determined.  The  code  uses  these 
stress  intensity  factors  for  crack  growth  predictions.  A  metallic  structure  with  composite  patch  can  be  modeled 
with  the  code  as  3  layers  (metal,  adhesive  and  composite  patch)  and  stress  intensity  factors  obtained.  These 
stress  intensity  factors  are  used  to  make  crack  growth  predictions  in  repaired  structure  under  constant 
amplitude  loading. 
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3.0  SAMPLE  PROBLEMS 
3.1  Fuselage  Frame  Repair 

Standard  repairs  are  generally  given  in  repair  manuals.  However,  in  many  cases  in-service  inspections  show 
damage  that  is  not  covered  by  standard  repair  manuals  and  a  special  repair  has  to  be  designed.  For  such  cases 
detailed  static  and  damage  tolerance  analyses  have  to  be  carried  out.  An  example  of  cracked  frame  in  a 
transport  aircraft  (Figure  4)  is  shown  in  Figure  5.  The  flange  and  the  web  of  the  frame  are  cracked  as  shown  in 
Figure  6a.  Standard  repair  manuals  generally  do  not  cover  a  repair  for  the  damage  shown  in  Figure  5.  The 
cross-sections  of  the  flange  and  web  repairs  are  shown  in  Figure  6b.  The  details  of  the  frame  repair  are  shown 
in  Figure  7. 


^  S43 


Figure  4.  Fuselage  Frame  Cracking  Location  in  Transport  Aircraft 
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Figure  5.  Cracked  fuselage  Frame 
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Figure  6a.  Section  Showing  Cracked  Frame  Figure  6b.  Section  Showing  Flange  and  Web  Repairs 
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Figure  7.  Details  of  Frame  Repair 
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STATIC  STRENGTH  DESIGN 

Ultimate  strength  of  flange  material  7075-T6  aluminum  is  assumed  to  be  75  ksi  (517.1  MPa). 

Load  Capacity  Lost  Due  to  Cracking 

1.  Flange  area  lost  due  to  cracking  =  (0.44+1.1)  x  0.063  =  0.097  in2  (62.6  mm2). 

Load  capacity  lost  =  0.097  x  75  =  7.275  kips  or  7,275  Lb. 

2.  Web  area  lost  =  3.5  x  0.063  =  0.221  in2  (142.6  mm2) 

Load  capacity  lost  =  0.221  x  75  =  16.575  kips  or  16,575  Lb. 

Total  Area  Lost  =  0.097+0.221  =  0.318  in2  (205.2  mm2) 

Total  Load  Capacity  Lost  =  7.275  +  16.575  =  23.850  kips  or  23,850  Lb. 

Repair  Analysis 

Repair  area  required  in  flange  =  1.25  x  Area  lost  =  1.25  x  0.097  =  0.121  in2  (78.1  mm2). 
Repair  area  added  in  flange  (Figure  6b)  =  (0.032  +  0.05)  x  1.1  +  (0.032  +  0.05)  x  0.8 

=  0.09  +  0.067  =  0.157  in2  (101.3  mm2). 

Repair  area  required  in  web  =  1.25  x  0.221  =  0.276  in2  (178.1  mm2). 

Repair  area  added  in  web  =  0.08  x  3.5  =  0.28  in2  (180.6  mm2). 

Total  area  added  in  flange  and  web  =  0.157  +  0.28  =  0.437  in2  (281.9  mm2). 

Margin  of  Safety  =  (Area  added  /  Area  lost)  -  1 . 

=  (0.437/0.318)- l.  =  1.37-1.  =  0.37 


Fastener  Requirements 

Using  HL18-6  HI-Lok  in  0.063,  7075-T6  sheet.  Allowable  loads  are  given  by- 
Ps  (Shear)  =  2,694  Lb. 

PB  (Bearing)  =  1,197  Lb. 

Number  of  Fasteners  Required  in  Flange  =  7,275  /  1,197  =  6  .07. 

Use  6  Fasteners. 

Number  of  Fasteners  Required  in  Web  =  16,575  / 1 , 1 97  =  13.8 
Use  15  Fasteners. 

Total  Fastener  Load  Capacity  =  21  x  1,197  =  25,137  Lb. 


3.2Composite  Reinforcement  of  T-38  Lower  Skin  in  Machined  Pockets 

Lower  wing  skin  pockets  in  T-38  aircraft  between  the  39%  and  44%  spars  and  33%  and  39%  spars  at  Wing 
Station  (WS)  78  have  shown  a  propensity  for  crack  initiation  and  propagation  during  service.  The  cracks  have 
initiated  at  the  pocket  radius  in  the  inner  moldline  of  the  wing  skin.  This  cracking  has  been  occurring  primarily 
under  Lead-in-Fighter  (LIF)  spectrum  loading.  These  areas  are  ideal  for  composite  reinforcement  to  reduce 
stress  levels  and  enhance  fatigue  life.  As  there  is  no  access  for  bonding  reinforcement  on  the  inner  moldline,  a 
one  sided  reinforcement  bonded  onto  the  outer  moldline  of  the  wing  skin  was  selected  (Reference  4). 
Composite  reinforcement  bonded  to  the  wing  is  shown  in  Figure  8. 
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Figure  8.  Location  of  Composite  Reinforcement  on  Lower  Wing  skin 


A  detailed  finite  element  analysis  of  the  local  area  with  and  without  composite  reinforcement  was  carried  out 
(Reference  4).  The  finite  element  model  of  the  structure  is  shown  in  Figure  9.  Typical  output  of  the  outer 
moldline  stresses  is  shown  in  Figure  10.  Using  NASTRAN  stresses,  a  detailed  damage  tolerance  analysis  of 
the  pocket  area  was  carried  out  using  AFGROW  computer  code. 
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Figure  9.  Finite  Element  Model 


MS C/PAT RAN  Version  6.2  18-Dec-97  17:07:04 

TENSOR:  BASE96004.SC1060,  Static  Subcase:  Stress  Tensor  At  Z1  -MSC/NASTRAN 


Figure  10.  Typical  NASTRAN  Output  Showing  Element  Stresses 
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Structural  testing  of  the  T-38  wing  at  Wright  Patterson  Air  Force  Base  has  been  carried  out  under  LIF 
spectrum  loading  (Reference  4).  Prior  to  the  fatigue  testing  of  the  wing,  strain  gages  were  applied  to  the  lower 
wing  skin  pocket  area.  The  strain  surveys  of  the  pocket  areas  were  performed  prior  and  subsequent  to  the 
bonding  of  the  reinforcement. 

The  location  of  the  strain  gages  on  the  wing  is  shown  in  Figure  11.  The  strain  survey  was  carried  out  for  the 
two  most  critical  load  conditions  (namely  S0985  and  10556)  to  50%  of  limit  load.  The  stress  analysis  of  the 
pocket  area  was  performed  using  coarse  mesh  and  fine  mesh  finite  element  models.  The  comparison  of  test 
strains  and  analytical  strains  for  the  pocket  between  39%  and  44%  spars  obtained  from  both  models  is  shown 
in  Figure  12.  The  figure  shows  that  for  condition  S0985,  both  finite  element  models  show  a  good  correlation 
with  the  test  results.  However,  for  condition  10556,  only  the  fine  mesh  results  correlate  well.  The  coarse  mesh 
results  are  shown  to  be  slightly  higher. 


“D”  PANEL  x  44%  SPAR 

Figure  11.  Strain  Gage  Location  in  the  pocket  Area  of  T-38  Wing  Skin 


A  good  comparison  between  analysis  and  full  scale  test  indicates  that  finite  element  analysis  can  reliably 
predict  structural  behavior  with  proper  modeling  techniques  and  applied  boundary  conditions.  The  stresses 
from  finite  element  analysis  along  with  appropriate  loads  spectrum  can  be  used  in  any  of  the  damage  tolerance 
codes  to  make  crack  growth  and  residual  strength  predictions. 

4.0  CONCLUDING  REMARKS 

A  number  of  codes  are  available  to  perform  damage  tolerance  analysis  and  design  repairs  for  aging  aircraft 
fleet.  Most  of  these  codes  are  available  in  public  domain  at  no  cost  to  the  users.  These  codes  have  a  good  user 
interface  and  are  user  friendly.  The  operation  of  these  codes  does  not  require  expert  knowledge.  With  little 
training  and  some  knowledge  of  fracture  mechanics,  these  codes  can  be  very  effectively  used  to  make  life 
predictions  of  aircraft  structures.  These  codes  can  assist  in  selecting  right  life  enhancement  techniques, 
designing  repairs,  and  identifying  inspection  requirements.  The  application  of  these  codes  will  reduce  down 
time  of  an  aircraft  for  repairs. 
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Figure  12.  Comparison  of  Observed  and  Predicted  Strains  in  Pocket  Between  39%  and  44% 

Spars  (No  Composite  Reinforcement) 
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INSPECTION  TECHNOLOGIES 
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1.0  INTRODUCTION 

Regular  maintenance  of  airframe  is  an  important  aspect  of  assuring  flight  safety  of  aircraft  structures.  One 
technology  area,  which  plays  an  important  role  in  proper  maintenance  and  assuring  the  flight  safety  of  aircraft, 
is  the  inspection  at  regular  intervals.  Reliable  visual  and  nondestructive  inspection  (NDI)  methods  are  needed 
to  assure  the  airworthiness  of  these  aircraft  and  at  the  same  time  keeping  maintenance  costs  to  a  minimum. 
Commercial  aircraft  maintenance  programs  are  shown  in  Figure  1.  For  military  aircraft  the  inspection 
requirements  are  generally  defined  by  Integrated  Logistic  Support  (ILS)  organization  for  non-critical 
components.  For  critical  components,  the  inspections  are  defined  by  damage  tolerance  analysis. 


1.  Corrosion  Inspection  Program 

Level  1-  Local  corrosion  that  can  be  removed  within  allowable  limits. 

Level  2-  Local  corrosion  that  exceeds  allowable  limit.  This  requires  repair  or 
partial/complete  replacement. 

Level  3-  Potential  urgent  airworthiness  concern  requiring  expeditious  action. 

Note-  Airline’s  existing  maintenance  programs  must  control  all  primary  structures 
to  level  1  or  better. 

2.  Periodic  Maintenance  Inspections 

A  Check-  Visual  inspection  of  interior  and  exterior  every  65  to  75  hours. 

B  Check-  Access  panels  removed  for  inspection  and  engine  servicing  every  30  days. 
C  Check-  Heavy  structural  and  maintenance  check  after  every  5,500  flying  hours. 

D  Check-  Interior  stripped  to  fuselage  walls  every  20,000  to  25,000  flying  hours. 


Figure  1.  Commercial  Aircraft  Maintenance  Programs 


For  in-service  military  aircraft,  the  inspection  requirements  may  be  defined  by  the  usage  (e.g  lead-in-fighter, 
dissimilar  air  combat,  air  training  command,  etc.).  Using  the  stress  analysis  and  loads  data,  it  is  possible  to 
predict  the  life  of  a  structural  component  with  durability  and  damage  tolerance  analyses  techniques.  From  the 
crack  growth  analysis  of  a  critical  area  of  a  structural  component  under  actual  spectrum,  experienced  by  a 
structural  component,  it  is  possible  to  identify  initial  inspection  and  subsequent  inspection  requirements  as 
shown  in  Figure  2.  The  crack  growth  curve  for  a  critical  location  is  obtained  from  assumed  initial  flaw  a0, 
based  on  damage  tolerance  requirements,  to  critical  size  a c  at  which  the  flaw  grows  to  be  catastrophic  at  Nf 
flight  hours.  If  the  inspection  capability  of  the  Non-Destructive  Inspection  (NDI)  equipment  to  be  used  in  field 
or  depot  is  ai ,  then  the  cycles  to  grow  the  crack  from  a0  to  ai  are  determined  to  be  Ni.  The  initial  inspection 
requirement  is  given  by  Ni/2  and  subsequent  inspection  requirements  are  given  by  (Nf  -Ni)/2. 


Paper  presented  at  the  RTO  AVT  Lecture  Series  on  “ Aging  Aircraft  Fleets:  Structural  and  Other 
Subsystem  Aspects” ,  held  in  Sofia,  Bulgaria,  13-16  November  2000,  and  published  in  RTO  EN-015. 
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Figure  2.  Initial  and  Subsequent  Inspection  Requirements  from  Crack  Growth  Life 


The  procedure  outlined  in  Figure  2  is  used  to  zone  an  aircraft  structure  for  inspections  depending  on  the 
severity  of  loads  and  structural  details  such  as  thickness,  presence  of  substructure,  fastener  diameter  and  type, 
etc.  Typical  zoning  of  a  wing  structure  for  Air  Training  Command  (ATC)  usage  is  shown  in  Figure  3 
(Reference  1).  The  wing  in  the  figure  has  been  divided  in  5  zones,  namely  A,  B,  C,  D,  and  E.  The  fasteners  in 
each  zone  have  different  inspection  requirements  depending  on  the  structural  details  and  stress  levels.  The 
fasteners  in  zones  D  and  E  are  in  an  area  where  the  stresses  are  rather  small  and  crack  growth  life  is  very  large. 
The  zoning  and  inspection  requirements  depend  on  the  usage  of  an  aircraft,  as  the  load  spectrum  will  change 
with  the  usage.  For  usage  other  than  ATC  the  inspection  requirements  will  be  different  from  those  shown  in 
Figure  3,  however,  the  inspection  zones  may  still  be  the  same.  Analytical  techniques  provide  tools  to  define 
inspection  requirements  based  on  usage  and  structural  details  to  reduce  inspection  cost. 


ZONE 

ATC 

A 

2450/1200 

B 

8500/5500 

C 

11500/6000 

D 

>20000/>12500 

E 

>20000/>12500 

Figure  3.  Zoning  of  Military  Aircraft  Structure  for  Inspection 


This  paper  discusses  currently  available  techniques  for  detecting  damage  in  structures  and  their  limitations. 
Inspection  of  cracks  in  substructure  and  hidden  corrosion  has  always  presented  a  nightmare  for  NDI  engineers. 
Some  recent  advances  made  in  the  NDI  technology  to  solve  these  problems  are  discussed. 
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2.0  COMPARISON  OF  NONDESTRUCTIVE  INSPECTION  (NDI)  METHODS 

A  number  of  visual  and  nondestructive  inspection  methods  are  available  for  inspection.  However,  their 
application  to  detect  flaws  depends  on  the  type  of  structure,  access,  desired  degree  of  accuracy,  and  inspection 
time.  The  comparison  of  conventional  NDI  methods  is  shown  in  Figure  4. 
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Figure  4.  Comparison  of  NDI  Methods 


The  advantages  and  disadvantages  of  various  NDI  methods  (References  2-3)  are  shown  in  Figure  5  along  with 
their  applications.  Some  of  these  techniques  are  discussed  in  the  following  paragraphs. 


NDI  Method 

Detection  Application 
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structures 

for  direct  visibility 

Penetrant 

Surface  cracks  in  metals 

Simple  to  use,  accurate, 
fast,  easy  to  interpret 

Surface  defects  only, 
access  required,  defect 
may  be  covered 

High 

Surface  defects,  cracks, 

Useful  for  detecting  cracks 

Trained  operators, 

Frequency 

intergranular  corrosion, 

at  holes  not  detectable  by 

special  probes  for  each 

Eddy  Current 

pits,  heat  treat 

visual  or  penetrant,  fast, 
sensitive,  portable 

application,  reference 
standards  required 

Low 

Subsurface  defects, 

Useful  for  detecting  cracks 

Trained  operator,  time 

Frequency 

corrosion  thinning 

under  fasteners  or  substruc¬ 

consuming,  special  probe 

Eddy  Current 

ture  without  disassembly 

for  each  application 

Sonic 

Delaminations,  debonds, 

One  side  access,  does  not 

Difficult  to  interpret 

voids,  and  crushed  core  in 

require  paint  removal  or 

results,  loses  sensitivity 

composites,  honeycombs 

surface  preparation 

with  increasing  thickness 

X-Ray 

Internal  flaws  and  defects, 

Eliminates  disassembly 

Radiation  hazard,  trained 

corrosion,  inclusions  and 

requirements,  permanent 

operators,  crack  plane 

thickness  variations 

record,  high  sensitivity 

must  be  parallel  to  x-ray 
beam,  special  equipment 

Magnetic 

Surface  and  sub-surface 

Simple,  portable,  easy  to 

Trained  operator,  parts 

Particle 

defects  in  ferromagnetic 
materials 

use,  fast 

to  be  cleaned  before  and 
demagnetized  after  check 
Magnetic  flux  must  be 
normal  to  defect  plane 

Ultrasonic 

Surface  and  sub-surface 

Fast,  easy  to  operate, 

Trained  operator,  test 

defects,  cracks,  disbonds 
in  metals  and  composites 

accurate,  portable 

standards  required, 
electrical  source  needed 

Figure  5.  Relative  Advantages  and  Disadvantages  of  NDI  Techniques 
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3.0  PROBABILITY  OF  DETECTION  (POD) 

Probability  of  detection  (POD)  is  a  statistically  based  quantitative  measure  of  inspection  capability.  The  POD 
is  different  for  different  inspection  equipment  and  even  for  the  same  NDI  equipment  is  affected  by  a  number 
of  factors  such  as:  material  properties,  structural  details,  defect  shape,  inspection  conditions,  etc.  Another 
parameter  generally  associated  with  POD  is  the  confidence  level  with  which  a  flaw  can  be  detected.  A  95% 
confidence  level  is  considered  acceptable  for  flaw  detection.  An  NDI  equipment  capability  is  generally 
designated  as  90%  probability  of  detecting  a  flaw  with  95%  confidence  level.  The  POD  of  various  NDI 
equipment  for  through  the  thickness  damage  (Reference  4)  is  shown  in  Figure  6.  Figure  7  shows  POD  for  sub¬ 
surface  and  internal  defects.  These  figures  indicate  that  the  probability  of  detection  varies  significantly  with 
each  NDI  equipment. 


Crack  Length  (mm) 

Figure  6.  Probability  of  Detection  for  Through  the  Thickness  Defects 


Figure  7.  Probability  of  Detection  for  Sub-Surface  and  Internal  Defects 


4.0  VISUAL  INSPECTION 

Visual  inspection  is  a  sensing  mechanism  in  which  eye  alone  or  in  conjunction  with  other  aids  is  used  to  judge 
the  condition  of  a  component  being  inspected.  Visual  inspection  is  an  integral  part  of  airplane  maintenance  and 
is  considered  as  a  component  of  NDI.  Over  80  %  of  the  inspections  on  large  transport  aircraft  are  visual 
inspections.  On  small  aircraft  the  percentage  of  visual  inspection  is  even  higher.  Typical  defects  found  by 
visual  inspection  are  cracks,  corrosion  and  disbonding.  Detection  of  disbonding  due  to  corrosion  is  generally 
difficult;  however,  disbonding  may  be  accompanied  by  local  bulging  due  to  corrosion  or  entrapped  moisture 
and  may  be  easily  detectable. 
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Visual  inspection  is  perhaps  the  simplest,  most  economical  and  most  efficient  method  of  assessing  the 
condition  of  an  aircraft.  A  large  number  of  defects  are  generally  found  by  visual  inspection  and  the  operators 
depend  highly  on  the  visual  inspections  to  ensure  the  airworthiness  of  an  aircraft.  Hence,  visual  inspection 
plays  an  important  role  in  the  safe  operation  of  an  aircraft.  The  details  of  visual  inspection  are  given  in 
References  5-6. 

4.1  Factors  Affecting  Visual  Inspection 

The  manufacturer  or  regulatory  authorities  in  the  maintenance  or  overhaul  manuals  generally  specify  visual 
inspection  procedures.  A  number  of  factors  affect  the  results  of  visual  inspection.  Some  of  the  important 
factors  are: 

1)  Qualifications  and  Training  of  Inspection  Personnel-  Inspection  should  be  done  by  qualified  personnel  or 
under  the  supervision  of  qualified  personnel.  These  personnel  should  have  knowledge  of  the  structural 
details  being  inspected,  types  of  defects  which  are  commonly  found  and  the  causes  of  these  defects. 

2)  Inspection  Area  Access-  Proper  access  to  the  inspection  area  is  an  important  factor  in  the  reliability  of 
visual  inspection.  An  easy  access  to  the  component  to  be  inspected  will  assist  in  the  decision  making 
process  and  ability  to  interpret  results. 

3)  Lighting-  Proper  light  without  glare  is  essential  for  a  quality  visual  inspection.  Poor  lighting  can  mask  the 
defects  and  cause  fatigue  to  the  inspectors  there  by  affecting  their  judgment. 

4)  Pre-cleaning-  The  part  to  be  inspected  should  be  free  from  dirt,  contamination,  and  any  foreign  material  that 
will  obscure  the  detection  of  defects. 

5)  Working  Environment-  A  proper  working  environment  is  necessary  for  the  visual  inspectors.  Presence  of 
excessive  temperature,  wind,  rain  or  any  other  adverse  condition  can  influence  the  interpretation  capability 
of  operators  and  increase  the  potential  for  errors. 

4.2  Levels  of  Visual  Inspection 

Visual  inspection  is  divided  in  four  categories  (Reference  5),  namely:  1)  Walkaround  Inspection,  2)  General 
Visual  Inspection,  3)  Detailed  Inspection,  and  4)  Special  Detailed  Inspection. 

Walkaround  Inspection-The  purpose  of  a  walk  around  inspection  is  to  serve  as  a  quick  check  to  detect  any 
obvious  discrepancies  that  would  affect  the  performance  of  an  aircraft.  Most  maintenance  manuals  specify  a 
walkaround  inspection  on  a  periodic  basis.  Flight  or  maintenance  personnel  may  do  this  inspection  from  the 
ground.  This  inspection  includes:  fuselage,  left  and  right  wings,  leading  edges,  control  surfaces,  propeller  or 
fan  blades,  exhaust  areas,  pylons  and  gear  well.  The  walkaround  is  done  twice  to  make  sure  that  nothing  was 
missed  the  first  time.  The  inspector  looks  for  any  major  dents  in  the  skin,  missing  fasteners,  corrosion,  leaks 
etc. 

General  Inspection-A  general  inspection  of  an  exterior  is  carried  out  with  open  hatches  and  openings  of 
interior  to  detect  obvious  damage.  A  general  inspection  is  carried  out  when  a  problem  is  suspected  or  routinely 
when  panels  are  open  for  normal  inspection.  The  tools  required  for  this  inspection  include:  flashlight,  mirror, 
droplight,  rolling  stool,  ladder,  stand  and  tools  for  removing  panels. 

Detailed  Inspection-  A  detailed  inspection  is  required  when  a  specific  problem  is  suspected  or  general 
inspection  has  identified  some  problems.  This  inspection  is  an  intensive  examination  of  a  specific  area,  system, 
or  assembly  to  detect  any  damage,  failure  or  discrepancy.  Surface  preparation  and  special  access  may  be 
required  for  this  type  of  inspection  along  with  special  aids  in  addition  to  the  tools  required  for  general 
inspection. 

Special  Detailed  Inspection-  A  special  detailed  inspection  is  a  thorough  examination  of  a  specific  component, 
installation  or  assembly  to  detect  damage,  failure  or  any  discrepancy.  Disassembly  of  sub-components  and 
cleaning  may  be  required  for  this  type  of  inspection.  Tools  required  for  this  type  of  inspection  may  include 
flashlight,  mirror,  borescope,  image  enhancement  and  recording  devices,  rolling  stools  etc. 
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4.3  Visual  Inspection  Equipment 

Various  aids  are  used  for  visual  inspection.  One  of  the  most  important  aids  in  visual  inspection  is  the  proper 
lighting  and  illumination.  Reference  5  describes  the  ideal  lighting  and  illumination  required  for  proper  visual 
inspection.  The  reference  describes  various  portable  lighting  aids.  The  other  inspection  equipment  required 
include:  mirrors,  magnifiers  and  equipment  to  obtain  images  from  inaccessible  places  being  inspected. 

Inspection  Mirrors-  These  are  used  to  look  at  the  areas  which  are  not  in  the  normal  line  of  sight.  A  number  of 
different  mirrors  are  available  to  inspect  hidden  areas  (Reference  5). 

Magnifying  Devices-These  are  used  in  the  visual  inspection  to  expand  the  area  being  inspected  for  detecting 
damage  and  other  anomalies.  These  devices  include:  simple  magnifying  glass,  microscope  and  illuminated 
magnifiers. 

Photographic  and  Video  Systems-  A  photographic  image  of  the  area  being  inspected  enhances  the  decision¬ 
making  capability  of  an  inspector  to  interpret  what  he  sees.  Photographic  and  video  systems  are  available 
which  can  be  attached  to  borescope,  fiberscopes  or  any  other  visual  equipment  for  documentation  and 
interpretation  of  visual  inspection  images.  The  photographic  images  can  be  stored  as  permanent  records  for 
later  viewing.  A  number  of  systems  are  available  in  the  market. 

Borescopes-  A  borescope  is  a  tubular  precision  optical  instrument  with  built-in  illumination  to  allow  remote 
visual  inspection  of  internal  surfaces.  Borescope  tubes  may  be  rigid  or  flexible  and  are  available  in  a  wide 
variety  of  lengths  and  diameters.  These  are  available  in  a  number  of  designs  and  manufacturers  can  supply 
custom  made  borescopes  to  serve  customer  needs.  The  selection  of  a  borescope  depends  on  a  particular 
application  and  is  governed  by  factors  such  as-  resolution,  illumination,  magnification,  field  of  view,  working 
length,  direction  of  view,  etc. 

Borescopes  are  used  in  aircraft  structures  and  engine  maintenance  programs  to  inspect  the  areas  which  are 
difficult  to  reach  and  there  by  reduce/eliminate  costly  teardown  inspections.  These  can  be  used  to  inspect  the 
interiors  of  pipes,  hydraulic  cylinders,  turbine  blades  and  valves.  They  are  also  used  to  locate  foreign  object 
damage  and  verify  the  proper  placement  and  fit  of  seals,  bonds  and  gaskets. 

4.4  Visual  Inspection  of  Composite  Structures 

The  in-service  damage  in  composite  structures  is  quite  different  from  conventional  metallic  structures.  In 
metallic  structures  detection  of  cracks  and  corrosion  is  of  prime  concern  to  the  operators  whereas  in  composite 
structures  this  kind  of  damage  does  not  occur.  The  most  common  damage  occurring  in  composites  is  impact 
damage  which  may  result  in  internal  matrix  cracking,  fiber  breakage  and  delamination  between  plies  without 
any  appearance  of  external  damage  known  as  non- visible  impact  damage.  Fortunately,  all  composite  structures 
are  designed  for  non- visible  impact  damage. 

Any  serious  in-service  damage  that  may  affect  the  integrity  of  a  structure  has  to  penetrate,  chip  away  or  abrade 
the  paint  finish  of  the  composite  structure.  Any  damage  caused  by  hailstorm,  lightning  or  paint  strippers  will 
be  easily  visible  on  the  surface  and  can  be  detected.  Once  the  damage  has  been  detected,  the  affected  area 
needs  to  be  inspected  by  other  NDI  methods  for  assessing  the  effect  of  the  damage  on  structural  integrity. 
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5.0  NONDESTRUCTIVE  INSPECTION  METHODS 

As  mentioned  earlier  a  number  of  NDI  methods  are  available  and  the  use  of  a  specific  method  depends  on  the 
type  of  structure  being  inspected,  available  access  and  the  desired  degree  of  accuracy  in  the  inspection. 
Significant  advancements  have  taken  place  in  NDI  methods  recently.  The  methods  and  recent  advancements 
are  discussed  in  the  following  paragraphs. 

5.1  Eddy  Current 

Eddy  current  is  generally  used  to  detect  cracks  and  corrosion  near  the  surface  of  metallic  structures  or  in  thin 
structures.  Eddy  current  is  also  used  for  verifying  and  separating  alloys  by  differences  in  their  electrical 
conductivity.  This  technique  has  been  gradually  replacing  x-ray.  Hand-scanned  eddy  current  probe  coils  can 
detect  small  cracks  at  fastener  holes,  however,  the  method  is  time  consuming  and  tedious.  As  most 
conventional  eddy  current  instruments  display  variations  in  the  complex  impedance,  corrected  for  lift-off  as 
seen  by  the  probe  coil,  the  flaw  indications  may  be  sometimes  ambiguous.  This  generally  requires  trained  and 
experienced  operators  to  interpret  the  results.  Also,  the  lift-off  variations  produced  by  surface  roughness  or 
paint  thickness  can  result  in  false  calls.  The  paint  removal  may  be  required  prior  to  inspection  with 
conventional  eddy  current  equipment.  Recent  trends  in  eddy  current  technology  have  been  towards  the 
computerization,  automation,  improving  capabilities  to  detect  small  flaws  and  flaws  in  multi-layer  structures. 
Two  NDI  techniques  which  show  significant  promise  in  detection  of  corrosion  and  subsurface  cracks  without 
disassembly  are  Magneto-Optic/Eddy  Current  Imager  (MOI)  (References  7-10)  and  Low  Frequency  Eddy 
Current  Array  (LFECA)  (References  11-14). 

Magneto-Optic/Eddy  Current  Imager  (MOI)-  The  MOI  technique  makes  it  possible  to  do  faster,  simpler 
and  more  reliable  detection  of  cracks  and  corrosion  in  structures.  This  real-time  imaging  technology  is  based 
on  a  combination  of  magneto-optic  sensing  and  eddy  current  induction.  The  images  of  holes,  cracks  or  other 
defects  are  formed  as  the  presence  of  these  discontinuities  in  a  material  diverts  the  otherwise  uniform  flow  of 
current  near  the  surface  of  a  structure  as  shown  in  Figure  8  (Reference  8).  At  eddy  current  frequencies  of  25.6- 
102.4  kHz  most  through-the  thickness  fatigue  cracks  in  aluminum  are  easily  detected  and  imaged,  whereas  at 
lower  frequencies  (e.g.  6.4  kHz)  hidden  multi-layer  cracks,  corrosion  and  substructure  (Reference  7)  can  be 
imaged.  Figure  9  shows  POD  of  sliding  probe  and  MOI,  indicating  superior  performance  of  MOI.  Figure  10 
shows  typical  cracks  detected  by  MOI  and  Figure  1 1  shows  corrosion  detected  by  MOI. 


B  =  Induced  magnetic  field 


Figure  8.  Formation  of  Images  with  Magneto-Optic/Eddy  Current  Imaging 


Probability  of  DattcHoa 


Data  courtesy  of  Boeing  QAR&D  Group 


Crack  Length  (In)  measured  from  rivet  shank 
SLIDING  PROBE 


Data  courtesy  of  Boeing  QAR&D  Group 


Crack  Length  (in)  measured  from  rivet  shank 
MOI 


Figure  9.  Detection  POD  for  Sliding  Probe  and  MOI 


Specimen  with  Cracks  at  Fastener  Holes  MOI  Image 

Figure  10.  MOI  Image  of  Cracks  at  Fastener  Holes 
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Figure  11.  MOI  Image  of  Corrosion 


The  key  advantages  of  MOI  are  (Reference  7):  1)  Speed  of  operation  5  to  10  times  faster  than  conventional 
eddy  current,  2)  Easy  to  interpret  image  formation,  3)  No  false  calls,  4)  Elimination  of  paint  or  decal  for 
inspection,  5)  Easy  documentation  of  results  on  video  or  film,  and  6)  No  operator  fatigue. 


Low  Frequency  Eddy  Current  Array  (LFECA)-  The  LFECA  system,  developed  by  the  Northrop  Grumman 
corporation,  is  a  portable  eddy  current  inspection  equipment  to  detect  subsurface  cracks  under  installed 
fasteners  in  multi-layer  aircraft  structures  (References  11-14).  The  inspections  can  be  performed  in  near  real 
time  without  the  removal  of  fasteners.  The  LFECA  system  can  detect  cracks,  determine  crack  length  and  also 
give  crack  depth  and  orientation.  The  system  consists  of  a  LFECA  probe  for  inspection,  shown  in  Figure  12, 
three  printed  circuit  boards,  a  cable  and  software  all  assembled  in  a  portable  personal  computer.  The  LFECA 
probe  consists  of  a  cylindrical  core  made  from  ferrite  material  with  a  drive  coil  located  on  the  center  post  of 
this  core  to  generate  an  eddy  current  distribution  that  encircles  the  fastener  being  inspected.  An  array  of  16 
sense  elements,  spaced  evenly  around  the  outer  rim  of  the  core,  measures  the  spatial  distribution  of  these  eddy 
currents.  The  presence  of  a  crack  causes  a  disruption  in  the  eddy  current  distribution  and  is  measured  by  the 
sense  element  array.  The  outer  drive  coil  is  used  to  measure  the  response  due  to  the  adjacent  structural  features 
independent  of  the  features  at  the  structural  hole.  A  typical  response  obtained  from  the  LFECA  system  is 
shown  in  Figure  13  (Reference  11)  for  various  crack  sizes  along  with  the  probability  of  detection.  The 
horizontal  tick  marks  in  the  figures  indicate  the  16  angular  positions  around  the  fastener  hole  such  that  going 
from  left  to  right  will  indicate  going  around  the  fastener  hole  once.  The  horizontal  location  in  the  response 
indicates  the  orientation  of  the  crack  and  the  magnitude  of  the  peak  indicates  the  crack  length. 

The  probability  of  detection  of  cracks  with  the  LFECA  system  was  obtained  at  Federal  Aviation 
Administration  (FAA)  NDI  validation  center  at  Sandia  National  Laboratories  in  Albuquerque,  New  Mexico, 
USA  (References  11-13).  The  POD  process  consists  of  a  blind  test  of  eddy  current  equipment  to  inspect  a  lap 
joint  typical  of  a  commercial  airline  fuselage  shown  in  Figure  14.  The  process  involves  inspection  of  43 
specimens  with  each  specimen  containing  20  fastener  holes. 
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20  Rivets  Rows  per  Specimen  :  Only  Top  Rivets  Inspected 


Figure  14.  Boeing  737  Lap  Splice  Specimen  Configuration 

The  specimen  were  constructed  using  1  mm  thick  2024-T3  aluminum  sheets  which  were  fastened  together 
with  three  rows  of  4  mm  diameter  aluminum  flush  head  rivets.  Fatigue  cracks  were  grown  in  the  first  layer  of 
selected  holes  prior  to  riveting  the  panels.  A  range  of  crack  sizes  from  0.3  to  25  mm  (a  hole  to  hole  crack) 
were  grown  within  +/-  22  degree  orientation  (0  degrees  being  the  direction  from  hole  to  hole).  Holes  with 
cracks  on  one  and  both  sides  were  present.  Specimens  contained  either  none,  a  low,  a  medium  or  a  high 
number  of  cracks.  A  total  of  860  holes  were  inspected  with  708  being  unflawed  holes.  The  validation  exercise 
contained  only  the  first  layer  cracks  under  installed  fasteners.  Figure  15  shows  the  POD  for  the  LFECA  system 
and  conventional  eddy  current  techniques.  It  is  seen  that  POD  obtained  with  the  LFECA  system  far  exceeds 
that  obtained  with  the  conventional  system. 


PROBABILITY 

OF 

DETECTION 


CRACK  LENGTH  (mm) 


CRACK  LENGTH  (Inches) 


Figure  15.  Probability  of  Detection  with  Low  Frequency  Eddy  Current  Array  and  Conventional 

Eddy  Current  NDI  System 
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5.2  Ultrasonic  Methods 

Ultrasonic  inspection  techniques  are  widely  used  for  quick  and  relatively  inexpensive  evaluation  of  flaws  in 
composite  structures.  Portable  inspection  devices  are  used  for  on-site  inspection  of  areas  with  suspected 
damage.  Two  methods,  namely  pulse-echo  and  through-transmission,  are  used.  In  the  pulse-echo  method,  a 
transducer  transmits  the  ultrasound  and  the  same  transducer  receives  the  reflected  signal  after  the  signal  has 
been  reflected  from  the  back  surface  of  the  composite  part  being  inspected.  The  attenuation  of  the  reflected 
pulse  is  influenced  by  the  presence  of  the  internal  defects,  and  the  time  delay  of  the  reflected  pulse  is  related  to 
the  depth  location  of  the  defect.  This  method  is  generally  used  in  contact  mode  of  testing  and  only  one  side 
access  is  required.  Inspection  of  honeycomb  structures  will  require  access  from  both  sides  for  inspection  of 
both  face  sheets.  Ultrasonic  inspection  using  through  transmission  method  is  generally  conducted  with  water 
as  a  couplant  by  two  methods-  1)  Immersion,  and  2)  Squirting.  In  the  immersion  method  the  part  and 
transducer  are  immersed  in  water  whereas  the  squirting  method  employs  dynamic  water  column  that  is 
squirted  and  the  transducer  and  the  part  are  suspended.  In  both  methods  water  acts  as  the  medium  that 
transmits  the  ultrasound  into  and  out  of  the  part.  The  images  of  the  defects  may  be  recorded  as  B-scan,  C-scan 
or  3-D  scan.  Scans  for  typical  impact  damage  in  a  composite  part  are  shown  in  Figure  16. 


C-SCAN 


B-  SCAN  3-D  SCAN 

Figure  16.  B,  C  and  3-D  Scans  of  Typical  Impact  Damage  in  Composite  Laminate 


An  ultrasonic  technique  to  detect  corrosion  in  a  wing  box  has  been  developed  in  Reference  15.  The  technique 
has  been  successfully  used  to  detect  corrosion  in  DC-9  wing  box  substructure.  The  current  method  of 
inspection  is  to  enter  the  wet  wing  box  for  corrosion  inspection.  The  technique  of  Reference  15  eliminates 
entry  in  the  wing  box  for  the  inspection  and  will  result  in  significant  savings  in  the  inspection  costs. 
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5.3  Radiographic  Methods 

The  present  trend  seems  to  be  getting  away  from  using  radiographic  methods  due  to  safety,  cost  and 
maintenance  logistics.  However,  these  methods  are  still  being  used  to  detect  internal  cracks  and  corrosion  in 
aging  aircraft  structures.  An  advanced  system  known  as  COMSCAN,  developed  by  Phillips,  allows  to  form 
images  of  underlying  structure  and  requires  access  to  one  side  of  the  part  only.  It  is  currently  being  used  to 
find  corrosion  in  bulkheads  under  thin  skins,  and  sonar  dome  inspections.  The  system  is  limited  to  finding 
defects  near  the  surface  and  has  the  same  detection  capability  as  conventional  x-ray.  Digiray  makes  a  system 
that  has  better  resolution  and  better  image  quality  than  the  conventional  systems.  The  system  is  basically  the 
reverse  of  a  conventional  digital  x-ray  imaging  system  as  shown  in  Figure  17.  The  x-ray  source  is  formed  by  a 
large  scanned  screen  like  a  TV  screen  and  the  detector  is  a  single  point  sensor  as  shown  in  the  figure. 


X-Ray  Film 
or  Image  Imensificr 


—  — Scattered  Radiation 


Figure  17.  Conventional  and  Reverse  Geometry  X-Ray  Radiography 
5.4  Acoustic  Emission 

The  acoustic  emission  (AE)  technique  is  used  to  identify  the  flaw  characteristics  by  change  in  acoustic 
emission  signal.  Acoustic  emissions  are  transient  waves  that  are  generated  by  the  rapid  release  of  energy 
within  a  material  when  it  undergoes  deformation  or  fracture.  This  technique  has  been  used  to  detect  damage  in 
composite  materials  and  cracks  in  metallic  structures.  Various  types  of  damages  in  composites  such  as  matrix 
cracks,  fiber/matrix  debonding,  fiber  fracture  and  delaminations  produce  acoustic  emissions  that  vary  in 
magnitude,  duration  and  frequency.  Various  damages  in  composite  materials  can  be  identified  by  the  acoustic 
emission  characteristics.  Cracks  in  aircraft  wing  were  located  during  ground  test  with  AE  technique  in 
Reference  16  using  AE  sensors  20  inch  (51  mm)  apart.  However,  the  source  location  of  flaws  could  not  be 
precisely  predicted. 
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5.5  Optical  Methods 

Significant  advancements  have  taken  place  in  optical  methods  to  detect  damage  in  aircraft  structures.  Some  of 
the  techniques  being-  shearography,  DIAS  system  and  thermography. 

Shearography-  This  is  a  field  inspection  technique  which  images  internal  defects  as  concentration  of  surface 
strain  due  to  an  applied  stress.  A  reference  image  is  stored  electronically  using  the  shearography  video  laser 
interferometer,  then  a  uniform  stress  is  applied  in  the  form  of  vibration,  pressure  or  thermal,  and  the 
subsequent  images  of  the  test  part  are  compared  with  the  reference  image  which  will  indicate  flaws  on  video 
monitor  (References  17-18).  This  is  a  cost-effective  method  for  inspection  of  honeycomb  and  composite 
structures.  Most  of  the  other  NDI  techniques  do  point  by  point  inspections  whereas  shearography  provides  a 
full  field  video  image  of  flaws  in  real  time.  Defects  such  as  disbonds,  delaminations  and  impact  damage  can  be 
detected  with  this  technique. 

D  Sight  Aircraft  Inspection  System  (DAIS)-  This  is  a  fast  and  sensitive  enhanced  visual  inspection  system 
for  detecting  surface  irregularities  such  as  pillowing  caused  by  corrosion  (References  19-20).  In  Reference  19, 
DAIS  system  was  used  in  the  laboratory  as  well  as  in  the  field  to  detect  corrosion  in  fuselage  lap  splices.  The 
results  of  this  reference  showed  that  corrosion  pillowing  indicative  of  thickness  loss  as  low  as  2%  is 
detectable.  A  typical  D  sight  optical  set-up  is  shown  in  Figure  18. 


Figure  18.  D  Sight  Optical  Set-up 

A  comparison  of  fuselage  joint  corrosion  detected  by  X-ray  and  D  Sight  is  shown  in  Figure  19.  The  figure 
shows  a  very  good  correlation  between  the  two  techniques. 
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Boeing  121  fuselage  lap  joint  corrosion,  analyzed  using  D  Sight 

Figure  19.  Comparison  of  Fuselage  Joint  Corrosion  Detected  by  X-Ray  and  D  Sight  Techniques 


Thermography-  This  technique  uses  differential  in  the  thermal  conductivity  of  a  defect  free  part  and  a  part 
with  defects  as  a  basis  for  locating  defects  in  a  structure.  A  heat  source  is  used  to  elevate  the  temperature  of  the 
structure  being  inspected  and  surface  heating  effects  are  observed  through  a  radiometer.  For  example  bonded 
areas  conduct  more  heat  than  unbonded  areas,  the  amount  of  heat  either  absorbed  or  reflected  indicates  the 
quality  of  the  bond  line. 

A  new  technology  known  as  “Thermal  Wave  Imaging”  uses  pulses  of  heat  to  examine  the  subsurface  in  solid 
objects  (Reference  21).  The  pulses  propagate  in  the  structure  being  examined  as  thermal  waves  and  are 
reflected  from  any  defects,  present  in  the  structure,  as  surface  “echoes”.  These  echoes  are  detected  by  the  use 
of  infrared  video  cameras,  coupled  to  appropriate  hardware  and  software.  The  patterns  of  the  echoes  on  the 
surface  of  the  structure  are  used  to  image  subsurface  corrosion  and  disbonds  in  aircraft  structures. 
Thermographic  inspection  technique  for  detection  of  water  ingress  in  sandwich  structures  is  discussed  in 
Reference  22.  It  is  shown  in  the  reference  that  this  technique  can  be  reliably  used  to  detect  water  in  sandwich 
structures. 

6.0  NONDESTRUCTIVE  INSPECTION  OF  METALLIC  STRUCTURES  REPAIRED  WITH 
COMPOSITES 

Nondestructive  inspection  of  composite  patch  repair  of  metal  structure  involves  two  inspection  issues-  1) 
inspection  of  bondline  for  disbonds,  and  2)  inspection  of  cracks  underneath  the  repair  patch.  Bondline 
inspection  has  been  reliably  carried  with  Kraut  Kramer  Branson  bond  tester.  Other  bondtester  such  as  Fokker 
bondtester  have  also  been  used. 

Application  of  eddy  current  procedure  to  detect  cracks  underneath  a  composite  repair  has  been  investigated  in 
Reference  23.  A  comparison  of  measured  crack  length  using  eddy  current  and  anticipated  crack  length  is 
shown  in  Figure  20.  The  figure  shows  the  actual  crack  length  when  the  crack  was  visible  outside  the  patch  and 
dotted  line  represent  the  anticipated  crack  length  when  the  crack  was  not  visible.  A  comparison  between  NDI 
measured  crack  length  and  anticipated  length  is  good. 


14-16 


1.2 


cn 

O 

o  1-0 

C 


+  0.8 
i  °*6 

u 

j 

a  o.4 

g 

o 

D.  2 

k 

0.0 


Measured  Crack  Growth 


-U0 


Cddy  Current 
Measurements 


V, 

o^°° 


epe 


V 


C0 


.coo0 


Initial  Crack  Length 


X 


o 


0.5 


Assumed  Crack  Growth 
While  Crack  Not  Visible 


X 


25 


]20 

15 

10 

5 

9 


2.0 


% 

X 

Sb 

c: 

o 

u 

cd 


1-0  1,5 

Number  of  Lifetimes 

Figure  20.  Comparison  of  Measured,  Using  Eddy  Current,  and  Anticipated  Crack  Lengths 

Conventional  eddy  current  seems  to  be  effective  in  detecting  crack  lengths  of  0.25-inch  or  larger.  However,  for 
smaller  crack  lengths  Low  Frequency  Eddy  Current  Array  (LFECA)  system,  discussed  earlier,  has  shown 
promise. 


7.0  CONCLUDING  REMARKS 


Significant  advancements  have  been  achieved  in  NDI  technology  in  the  recent  past.  Some  of  the  advancements 
are  discussed  in  this  paper.  The  use  of  a  particular  NDI  method  is  highly  dependent  on  the  type  of  structure 
being  inspected,  structural  material,  desired  accuracy,  the  size  of  the  flaw  to  be  inspected,  type  of  damage, 
time  available,  and  the  labor  skill.  NDI  and  structural  engineers  have  to  make  proper  choices  to  assure  the 
reliable  detection  of  the  damage  with  desired  accuracy.  Structural  engineer  can  work  together  with  NDI 
engineers  to  identify  the  requirements.  Reliable  inspection  techniques  are  available  for  detection  of  damage  in 
metallic  structures  underneath  composite  repair  patches. 
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Abstract:  Human  error  is  cited  as  a  major  causal  factor  in  most  aviation  mishaps,  including  the  15% 
-  20%  that  involve  maintenance  error.  Errors  can  be  described  as  active  failures  that  lead  directly  to 
the  incident,  and  latent  failures  whose  presence  provokes  the  active  failure.  Typical  aviation 
maintenance  errors  are  presented  as  examples  and  two  approaches  to  human  error  reduction  given: 
incident  based  and  task  analysis  based.  Each  approach  provides  data  on  performance  shaping  factors, 
i.e.  situation  variables  that  affect  the  probability  of  error  occurrences.  Examples  are  given  of 
interventions  derived  from  analysis  of  incidents  and  from  task  analysis. 

1.  The  Need  for  Human  Factors  in  Maintenance:  A  sound  aircraft  inspection  and  maintenance  system  is 
important  in  order  to  provide  the  public  with  a  continuing  safe,  reliable  air  transportation  system  (FAA,  1993). 
This  system  is  a  complex  one  with  many  interrelated  human  and  machine  components.  Its  linchpin,  however, 
is  the  human.  While  research  and  development  related  to  human  factors  in  aviation  has  typically  focused  on 
the  pilot  and  the  cockpit  working  environment,  there  have  been  maintenance  initiatives.  Under  the  auspices  of 
the  National  Plan  for  Aviation  Human  Factors,  the  FAA  has  recognized  the  importance  of  the  role  of  the 
human  in  aircraft  safety,  focusing  research  on  the  aircraft  inspector  and  the  aircraft  maintenance  technician 
(AMT)  (FAA,  1991,  1993).  The  classic  term,  “pilot  error”  or  “human  error”,  is  attributed  to  accidents  or 
incidents  over  75%  of  the  time;  however,  a  recent  study  in  the  United  States  found  that  18%  of  all  accidents 
indicate  maintenance  factors  as  a  contributing  agent  (Phillips,  1994). 

Two  incidents  help  clarify  the  issues  involved  and  demonstrate  that  even  though  humans  in  the  system  were 
trying  to  do  a  good  job,  systems  problems  combined  with  errors  to  allow  a  serious  event. 

Case  1:  Lockheed  L-1011.  An  in-flight  turn-around  was  caused  by  all  three  engines  failing  on  a 
flight  from  the  USA  to  the  Caribbean  when  the  oil  leaked  out  of  each.  The  oil  leak  was  caused  by 
missing  “O”  rings  on  the  magnetic  chip  detectors.  They  were  missing  because  the  mechanic  had  not 
notices  that  the  new  chip  detectors  were  not  fitted  with  “O”  rings  in  the  usual  way.  All  work  was 
performed  outside  in  darkness,  where  a  black  “O”  ring  was  difficult  to  see.  Until  that  night,  chip 
detectors  had  always  come  with  “O”  rings  attached,  even  though  the  mechanic  had  to  sign  for  both 
components.  The  new  packaging  still  said  they  were  ready  for  use. 

Case  2:  BAC-111.  During  industrial  action  at  the  airline,  a  maintenance  manager  changed  a 

windshield  himself.  He  had  not  performed  this  task  for  two  years,  but  checked  the  Maintenance 
Manual  and  it  looked  straightforward.  He  replaced  80  of  the  84  bolts.  The  correct  bolts  were  A21 1- 
8D,  although  A21 1-7D  were  on  the  old  windshield.  He  matched  the  old  bolts  to  new  ones  in  a  stores 
bin,  but  chose  A211-8C,  which  was  the  correct  length  but  the  wrong  thread.  They  engaged  in  the 
holes,  but  he  used  the  wrong  torque  in  setting  them.  Also  because  of  the  awkward  posture  required 
he  could  not  see  the  bolts  tighten.  On  the  first  flight,  the  windshield  blew  out,  severely  injuring  the 
pilot  and  forcing  an  in-flight  turn-around. 

As  a  result  of  such  incidents,  the  public  has  become  more  aware  of  the  importance  of  aircraft  maintenance  as  a 
safety  issue,  and  both  the  civil  aviation  industry  and  its  regulatory  bodies  have  responded  with  programs  to 
increase  safety.  Such  programs  have  included  hardware-based  initiatives,  such  as  the  FAA’s  Aging  Aircraft 
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Program,  and  human  factors  initiatives  by  the  FAA  and  many  international  bodies,  for  example  by  Transport 
Canada  and  the  European  JAA. 

Over  the  last  decade  various  human  factors  studies  in  maintenance-related  issues  have  been  initiated  by 
agencies  such  as  the  FAA  and  NASA,  by  manufacturers,  and  by  the  aircraft  maintenance  industry.  Examples 
of  these  initiatives  are  the  National  Aging  Aircraft  Research  Plan  (NAARP),  the  “Safer  Skies”  initiative,  the 
White  House  Panel  on  Aviation  Safety,  and  NASA’s  aircraft  maintenance  program.  The  objective  of  all  these 
has  been  to  identify  research  issues  and  to  promote  and  conduct  both  basic  and  applied  research  related  to 
human  factors  in  aircraft  maintenance.  The  human  factors  approach  in  maintenance  research  considers  the 
human  as  the  center  of  the  system.  Not  only  can  human  factors  research  have  a  significant  effect  on  the  design 
of  new  systems  but  it  can  also  mitigate  problems  found  in  the  sub-optimal  designs  of  current  systems. 

2.  Human  Factors  Approaches  to  Maintenance:  Clearly,  the  main  issue  in  aviation  from  a  safety  viewpoint 
is  errors,  or  alternatively  reliability.  Where  humans  are  part  of  the  system,  errors  cannot  be  separated  from  the 
other  two  aspects  of  humans  at  work:  performance  speed  and  human  well-being.  Performance,  typically 
measured  by  both  reliability  and  speed,  is  the  major  concern  of  employees.  Human  well-being,  e.g.  health  and 
safety  of  the  workforce,  is  also  an  employer  concern  but  is  vital  to  continuing  human  work  within  a  system. 
To  some  extent,  there  are  tradeoffs  between  speed,  reliability  and  well-being,  but  any  human  factors  changes 
we  make  to  improve  the  human/system  fit  can  be  expected  to  have  a  beneficial  impact  on  all  three  measures. 
For  this  reason,  our  main  consideration  in  this  paper  will  be  error  reduction,  or  its  equivalent:  reliability 
improvement. 

Perhaps  the  most  widely  accepted  error  models  arise  from  systems  reliability  analysis  (e.g.  Embrey,  1984)  but 
in  the  human  error  field  more  cognitive  models  have  gained  wide  acceptance.  These  were  originally 
developed  for  tasks  such  as  aircraft  piloting,  industrial  process  control  or  air  traffic  control  (Nagel,  1988).  The 
ideas  of  Reason  (1990)  concerning  error  in  complex  systems  have  been  particularly  influential. 

Reason  differentiates  between  the  proximal  cause  of  an  accident,  the  Active  Failure,  and  more  hidden  causes 
that  make  the  accident  sequence  more  likely,  the  Latent  Failures  or  Resident  Pathogens.  Active  failures  are  at 
the  “sharp  end”  of  the  incident,  for  example  the  pilot  who  fails  to  prevent  an  aircraft  impacting  a  mountain, 
and  are  thus  usually  discovered  easily.  Resident  pathogens,  in  contrast,  can  lie  dormant  in  a  system  for 
considerable  periods  before  they  become  manifest.  In  the  L-1011  example,  the  active  failure  was  that  “O” 
rings  were  not  installed,  but  a  number  of  latent  failures  ensured  that  the  changed  parts  led  to  an  incident: 

1 .  The  mechanic’s  habituation  to  signing  for  both  components  even  when  they  came  as  an  assembled  unit. 

2.  The  dark  outside  environment  that  prevented  ready  detection  of  the  error. 

3.  The  assignment  of  the  same  mechanic  to  service  all  three  engines,  a  practice  no  longer  tolerated,  e.g.  for 
ETOPS  certification. 

4.  The  unchanged  packaging  and  lack  of  alerting  of  the  mechanic  to  the  change. 

In  Reason’s  model,  if  we  can  reduce  the  latent  failures,  then  the  active  failure  will  be  prevented.  We  try  to 
reduce  the  impact  of  latent  failures  by  attempting  to  prevent  error  propagation  through  a  system,  usually  by 
providing  barriers  (or  error  traps  or  recovery  mechanisms).  Thus,  in  the  above  example,  training  the  mechanic 
to  check  each  component  before  signing  would  be  a  barrier  to  error  propagation.  It  would  be  a  relatively  poor 
barrier  as  training  people  to  perform  unnatural  acts  is  not  particularly  reliable.  We  characterize  such  a  barrier 
as  being  porous.  Clearly,  if  enough  of  the  barriers  are  porous,  a  triggering  event  such  as  the  changed 
packaging  can  propagate  through  several  barriers  to  impact  public  safety.  In  aviation  the  aim  is  to  provide 
barriers  which  prevent  such  propagation.  In  fact,  a  system  that  has  only  a  single  barrier  is  considered  unsafe 
and  thus  prevents  an  aircraft  being  certified  as  airworthy.  At  times  it  may  not  be  apparent  from  initial  analyses 
that  there  is  only  a  single  barrier.  The  recent  crash  of  Concorde  in  Paris  gives  such  an  example. 
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There  are  two  complementary  ways  to  locate  resident  pathogens  in  any  system: 

1 .  Incident-based.  If  incidents  have  occurred,  then  detailed  analyses  of  them  will  list  resident  pathogens  as 
well  as  active  failures. 

2.  Task- Analysis -based.  Whether  or  not  incidents  have  occurred,  comparison  of  task  demands  with  human 
capabilities  will  locate  task  elements  where  errors  are  likely,  i.e.  resident  pathogens. 

Both  of  these  approaches  have  been  used  successfully  in  aviation  maintenance.  The  next  two  sections  cover 
products  of  the  FAA’s  Human  Factors  in  Aviation  Maintenance  and  Inspection  Program  over  the  past  decade 
and  provide  instances  of  usable  findings  to  help  achieve  non-porous  error  barriers.  More  comprehensive 
accounts  can  be  found  in  the  special  issue  of  International  Journal  of  Industrial  Ergonomics ,  Volume 
26(2000),  125-240,  and  in  the  Proceedings  of  the  IEA  2000/HFES  2000  Congress ,  Volume  3,  pages  766-798. 
Information  from  the  FAA’s  program  is  available  on-line  at  hfskyway. faa. gov. 

3.  Incident-Based  Approaches:  In  Section  1,  two  incidents  were  presented  to  illustrate  human  factors  in 
maintenance  accidents — an  incident-based  approach.  Similar  approaches  have  been  the  analysis  of  all 
maintenance-caused  accidents  investigated  by  the  National  Transportation  Safety  Board  (available  on 
hfskyway. faa.  gov)  and  the  development  of  a  set  of  prototypical  unsafe  behaviors,  known  as  the  “Dirty  Dozen” 
(Dupont,  1997).  The  Aviation  Safety  Reporting  System  (ASRS)  in  the  USA  can  also  be  searched  for 
maintenance-related  incidents  to  provide  additional  examples  of  latent  as  well  as  active  failures. 

Based  on  such  listings  of  maintenance-related  latent  failures,  several  incident  analysis  schemes  have  been 
proposed.  These  focus  at  least  initially  on  single  incidents,  whether  the  severity  of  the  incident  is  an  aviation 
catastrophe  (very  rare),  an  operational  incident  such  as  an  aircraft  diversion  (more  common)  or  even  an  error 
discovered  before  it  had  propagated  (quite  common).  There  is  good  evidence  that  the  same  latent  failures  are 
found  in  the  path  leading  towards  severe  incidents  as  in  paths  towards  incidents  of  less  consequence  (Schmidt 
et  al,  2000).  Typical  incident  investigation  systems  include  the  Human  Factors  Analysis  and  Classification 
System  -  HFACS  (Schmidt  et  al,  2000),  the  Proactive  Error  Reduction  System  -  PERS  (Drury,  Wenner  and 
Murthy,  1997)  and  the  Maintenance  Error  Decision  Aid  -  MEDA  (Rankin,  2000).  The  last  of  these  is  typical 
in  that  it  was  derived  from  applying  the  human  reliability  analysis  tradition  to  maintenance  incidents.  Typical 
errors  were  used  to  derive  Performance  Shaping  Factors  (PSF’s)  which  describe  situational  variables  that 
affect  error  likelihood,  such  as  poor  training  or  adverse  weather  conditions.  Hierarchical  lists  of  such  factors 
were  developed  and  used  to  provide  a  4-page  checklist  covering: 

Error  Types 

•  improper  installation  improper 

•  servicing,  improper/incomplete  repair,  improper  fault 

•  isolation/inspection/testing,  actions  causing  foreign 

•  object  damage,  actions  causing  surrounding  equipment 

•  damage,  and  actions  causing  personal  injury 

Contributing  Factors  (PSFs) 

1 .  Information- written  or  computerized  source  information  used  by  maintenance  technicians  to  do  their 
job,  e.g.,  maintenance  manuals,  service  bulletins,  and  maintenance  tips 

2.  Equipment,  tools,  and  parts 

3.  Airplane  design  and  configuration 

4.  Job  and  task 

5.  Technical  knowledge  and  skills 

6.  Factors  affecting  individual  performance-e.g.,  physical  health,  fatigue,  time  constraints,  and  personal 
events 

7.  Environment  and  facilities 

8.  Organizational  environment  issues-e.g.,  quality  of  support  from  other  Maintenance  and  Engineering 
organizations,  company  policies  and  processes,  and  work  force  stability 
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9.  Leadership  and  supervision-e.g.,  planning,  organizing,  prioritizing,  and  delegating  work 

10.  Communication-e.g.,  written  and  verbal  communication  between  people  and  between  organizations. 

Error  Prevention  Strategies :  existing  procedures,  processes,  and  policies  in  the  maintenance  organization 
that  were  intended  to  prevent  the  error,  but  did  not. 

Even  though  analysis  of  each  investigated  incident  produces  error  prevention  strategies  specific  to  that 
incident,  more  use  can  be  made  of  the  accumulated  data  from  many  incidents  to  guide  broader  policies. 
Wenner  and  Drury  (2000)  analyzed  data  from  130  incidents  that  had  resulted  in  ground  damage  to  civil 
aircraft.  These  incidents,  Ground  Damage  Incidents  (GDIs),  had  been  investigated  and  reported  to  the 
Technical  Operations  Department  of  an  airline  from  1992-1995. 

Initially,  each  GDI  report  was  reviewed  to  determine  the  specific  action  that  caused  the  ground  damage.  The 
reports  could  be  sorted  into  twelve  distinct  patterns  covering  almost  all  of  the  GDI  reports,  termed  here  as 
Hazard  Patterns  after  Drury  and  Brill  (1978). 

Next,  each  GDI  report  was  analyzed  to  determine  the  specific  active  failures,  latent  failures,  and  local  triggers 
that  contributed  to  the  incident.  A  scenario  was  then  developed  for  each  hazard  pattern,  illustrating  the 
common  factors  between  all  of  the  incidents.  Each  of  these  was  also  summarized  as  an  event  tree  illustrating 
how  each  of  the  latent  failures  contributed  to  the  final  damage  event.  This  form  of  analysis,  which  has  much 
in  common  with  Fault  Tree  Analysis,  was  originally  developed  by  CNRS  in  France  (Monteau,  1977).  The 
scenarios  developed  for  each  hazard  pattern  are  given  in  Table  1  with  their  frequencies. 


Table  1.  GDI  Hazard  Patterns 


Hazard  Pattern 

Number  of 
Incidents 

%of 

Total 

1 .  Aircraft  is  Parked  at  the  Hangar/Gate/Tarmac 

81 

62 

1 . 1  Equipment  Strikes  Aircraft 

51 

39 

1.1.1  T ools/Materials  Contact  Aircraft 

4 

3 

1.1.2  Workstand  Contacts  Aircraft 

23 

18 

1.1.3  Ground  Equipment  is  Driven  into  Aircraft 

13 

10 

1.1.4  Unmanned  Equipment  Rolls  into  Aircraft 

6 

4 

1.1.5  Hangar  Doors  Closed  Onto  Aircraft 

5 

4 

1.2  Aircraft  (or  Aircraft  Part)  Moves  to  Contact  Object 

30 

23 

1.2.1  Position  of  Aircraft  Components  Changes 

15 

12 

1.2.2  Center  of  Gravity  Shifts 

9 

7 

1.2.3  Aircraft  Rolls  Forward/Backward 

6 

4 

2.  Aircraft  is  Being  Towed/Taxied 

49 

38 

2.1  Towing  Vehicle  Strikes  Aircraft 

5 

4 

2.2  Aircraft  is  Not  Properly  Configured  for  Towing 

2 

2 

2.3  Aircraft  Contacts  Fixed  Object/Equipment 

42 

32 

2.3.1  Aircraft  Contacts  F ixed  Obj  ect/Equipment 

13 

10 

2.3.2  Aircraft  Contacts  Moveable  Object/Equipment 

29 

22 

Totals 

130 

130 

130 

100% 
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In  a  similar  way,  the  latent  failures  were  categorized  into  a  second  hierarchy  in  Table  2. 

Table  2.  Incidence  of  Latent  Failures 


SHELL  Model 
Category 

Latent  Failure 

Number  of 
Incidents 

%of 

Total 

Hardware 

72 

27 

HI 

Poor  Equipment 

72 

27 

Hl.l  Poor  Equipment:  Inappropriate  for  Task 

39 

15 

HI. 2  Poor  Equipment:  Mechanical  Problem 

33 

12 

Environment 

51 

19 

El 

Inadequate  Space 

30 

11 

El.l  Inadequate  Space:  Congested  Area 

22 

8 

El. 2  Inadequate  Space:  Ill-suited  for  Task 

8 

3 

E2 

Problems  with  Painted  Guidelines 

8 

E2.1  Guidelines:  Do  Not  Exist 

7 

3 

E2.2  Guidelines:  Do  Not  Extend  Out  of  Hangar 

4 

21 

1 

E2.3  Guidelines:  Not  Suitable  for  Aircraft 

10 

4 

Liveware  (Individual) 

34 

13 

LI 

Lack  of  Awareness  of  Risks/Hazards 

34 

13 

Liveware  -  Liveware 

108 

41 

LL1 

Poor  Communication 

29 

11 

LL1.1  Poor  Communication:  Between  Crew 

24 

9 

LL1.2  Poor  Communication:  Between  Shifts 

Personnel  Unaware  of  Concurrent  Work 

5 

2 

Correct  Number  of  People  Not  Used 

LL2 

Pressures  to  Maintain  On-Time  Departures 

8 

3 

LL3 

Pushback  Policies  Not  Enforced 

36 

14 

LL4 

19 

7 

LL5 

16 

6 

Total 

265 

100% 

Note:  Totals  exceed  the  number  of  incidents  due  to  multiple  latent  failures  per  incident. 


After  consistent  latent  failures  were  identified,  a  logical  structure  was  imposed  using  ICAO’s  SHELL  Model 
(ICAO,  1989).  For  the  tasks  leading  to  ground  damage,  no  software  failures  (e.g.  documentation  design)  were 
found.  Note  that  there  are  typically  multiple  latent  failures  for  each  hazard  pattern,  so  that  their  total  is  215 
rather  than  130. 

Next,  a  cross-tabulation  was  made  of  the  hazard  patterns  and  overall  latent  failures  to  give  the  results  in 
Table  3. 


Table  3.  Chi-Square  Analysis  of  the  Hazard  Patterns/Latent  Failure  Relationship 
*  Indicates  a  frequency  larger  than  expected 


HP  1: 
Aircraft 
Parked 

HP  1.1: 
Equipment 
Strikes 
Aircraft 

HP  1.2: 
Aircraft  (or 
Component) 
Moves  to 
Contact  Object 

HP  2: 

Aircraft  Being 
Towed/Taxied 

HP  2.3: 
Aircraft 
Contacts 
Equipment 

Hardware 

53* 

47* 

6 

19 

ii 

Environment 

20 

18 

2 

31* 

31* 

Liveware  (Individual) 

22 

10 

12* 

12 

9 

Liveware-Liveware 

62 

4 

31* 

46 

40 

This  data  table  was  tested  using  a  Chi-Square  test  and  found  a  significant  relationship  (X23  =  15.2,  p  <  0.001). 
Further  analysis  using  standardized  residents  gave  the  over-represented  cells  (denoted  by  *  in  Table  3).  These 
show,  for  example,  that  if  the  aircraft  is  parked,  hardware  latent  failures  are  over-represented  (HP1)  and  that 
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most  of  this  relationship  comes  from  equipment  striking  aircraft  (HP  1.1)  rather  than  HP  1.2.  In  fact,  this  cause 
was  usually  poorly-maintained  ground  equipment  striking  the  aircraft.  Similarly,  for  HP  1.2,  where  the  aircraft 
or  a  component  moved  to  contact  another  object,  most  of  the  incidents  involve  people  failures  (liveware,  and 
liveware-liveware  interaction).  These  were  in  fact  lack  of  awareness  of  on-going  activities  (L-L)  or  failure  to 
perceive  hazards  (L). 

In  this  way,  a  listing  could  be  made  of  those  latent  failures  associated  with  each  hazard  pattern.  These  in  turn 
defined  intervention  strategies  likely  to  be  successful  in  prevention  of  future  incidents.  Thus,  for  equipment 
striking  the  aircraft  (HP  1.1)  concentrating  on  maintenance  of  ground  equipment  would  be  a  more  successful 
intervention  strategy  then,  for  example,  improving  individual  motivation  or  training. 

4.  Task  Analysis-Based  Approaches:  The  earliest  approach  to  analysis  of  human  factors  in  aviation 
maintenance  was  task-analysis-based  (Lock  and  Strutt,  1985).  These  authors  followed  classical  human 
reliability  analysis  techniques  (e.g.  Swain,  1990)  to  break  down  an  aircraft  inspection  task  into  successively 
smaller  units  of  human  behavior.  Each  behavior  was  then  considered  for  its  error  potential  so  that 
performance  shaping  factors  and  interventions  could  be  developed. 

In  general,  task  analysis  proceeds  by  progressive  redescription  of  the  whole  task  into  successively  smaller 
units.  Thus,  the  overall  task  may  be  “check  tire  pressures  and  condition.”  If  the  aircraft  has  six  tires,  then  the 
pressure  and  condition  of  each  must  be  checked.  For  the  left  nosewheel  (for  example),  the  outer  surface  and 
bead  must  be  examined  for  a  series  of  defects  (tread  wear,  de-lamination,  cuts,  etc.),  and  so  on.  When  each 
step  is  described  in  sufficient  detail,  the  task  description  is  complete  and  task  analysis  can  begin  (e.g.  Drury, 
Paramore,  Van  Cott,  Grey,  and  Corlett,  1987).  In  task  analysis,  task  demands  are  compared  with  expected  human 
capabilities  to  determine  potential  human/  system  mismatches.  These  in  turn  define  error-prone  steps  so  that 
countermeasures  can  be  developed.  This  technique  was  used  as  part  of  the  structuring  of  the  FAA’s  Human 
Factors  in  Aviation  Maintenance  and  Inspection  Program,  beginning  with  analysis  of  many  inspection  tasks 
(Drury,  Prabhu  and  Gramopadhye,  1990).  From  these  came  a  set  of  generic  functions  (logically-related  groups  of 
tasks)  for  inspection,  that  were  later  expanded  to  cover  both  inspection  and  maintenance  (Drury,  Shepherd  and 
Johnson,  1997).  These  tasks  are  defined  in  Table  4. 

Table  4.  Generic  Function  and  Task  Descriptions  of  Maintenance  and  Inspection 


Maintenance 

Inspection 

Function 

Tasks 

Function 

Tasks 

Initiate 

Read  and  understand  workcard.  Prepare 

Initiate 

Read  and  understand  workcard. 

equipment,  collect  and  inspect  supplies. 

Select  and  calibrate  equipment. 

Site  Access 

Focate  and  move  to  worksite  with  equipment, 
parts  and  supplies. 

Site  Access 

Focate  and  move  to  worksite. 

Part  Access 

Remove  items  to  access  parts,  inspect  and 
store  items. 

Search 

Move  eyes  or  probe  across  area, 
stop  if  any  indication. 

Diagnosis 

Follow  diagnostic  procedures.  Determine 
parts  to  replace/  repair  and  collect/  inspect 
needed  parts/  supplies. 

Decision 

Re-examine  area  of  indication. 
Evaluate  indication  against 
standards  to  decide  if  defective. 

Replace/ 

Repair 

Remove  parts  to  be  replaced/  repaired,  repair 
and  replace. 

Reset 

Systems 

Add  supplies/  fluids.  Adjust  systems  to 
specifications,  inspect  and  buyback  if  needed. 

Close 

Refit  and  adjust  items  removed  for  access. 

Access 

Remove  equipment  parts  and  unused 
supplies. 

Respond 

Write  up  documentation  on  repair. 

Respond 

Write  up  documentation  for 
repair.  Mark  defect  for  repair. 
Return  to  search. 

BuyBack 

(performed  by  inspector) 

BuyBack 

Examine  repair  against 
standards  and  sign  off. 
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The  FAA/AAM  program  has  used  FAA  researchers,  human  factors  practitioners  and  airline  partners  to 
develop  and  test  systems,  procedures,  job  aids  and  computer  tools  designed  to  ease  the  utilization  of  human 
factors/  ergonomics  knowledge  within  aviation  maintenance  and  inspection.  We  have  developed  an 
application  methodology  in  which  each  individual  project  teams  a  researcher  with  an  airline  partner.  Most  of 
the  major  air  carriers  in  the  USA  have  now  taken  part  in  these  projects.  Projects  have  included  design  of 
computer-based  training  programs,  design  of  enhanced  maintenance  documentation,  development  of  human 
factors  audit  programs,  and  applications  of  concepts  such  as  team  training  and  group  situation  awareness  to 
maintenance.  The  tools  and  job  aids  developed  on  these  projects  have  been  made  available  to  the  aviation 
industry,  initially  on  CD-ROM  but  more  recently  on  the  World  Wide  Web. 

A  good  overview  of  the  program  is  given  in  Latorella  and  Prabhu  (2000).  Interventions  have  been  proposed, 
researched  and  developed  for  many  of  the  functions  in  Table  4.  A  classification  of  these  (up  to  1997)  is  given 
in  Table  5  from  Drury,  Shepherd  and  Johnson  (1997).  Note  that  these  are  also  system-level  actions  such  as  the 
development  of  Crew  Resource  Management  (CRM)  training  for  maintenance,  now  characterized  as  Maintenance 
Resource  Management  (MRM)  (see  Taylor  and  Christensen,  1998).  Currently,  training  of  maintenance  personnel 
in  human  factors  concepts  is  the  most  popular  intervention  for  maintenance  human  error.  Indeed,  such  training  is 
now  mandated  by  the  International  Air  Transport  Association  (IATA)  and  by  the  regulatory  authorities  in  many 
countries. 

Table  5.  Classification  of  Interventions  for  Human  Factors  in  Maintenance  and  Inspection 


System  Level  Actions 


Development  of  Human  Factors  Audit  Programs 
CRM  Analysis  of  Maintenance  and  Inspection 
CRM  Training  for  Maintenance  and  Inspection 
Hangar-Floor  Ergonomics  Programs 


Characterization  of  Visual  Inspection  and  NDI 
Error  Analysis  and  Reporting  Systems 
PENS  System  for  Audit 
Human  Factors  Guide 


Function-Specific  Interventions 


Function 

Personnel  Subsystem 

Hardware/SoftwareSubsystem 

Initiate  Inspection 

Workcard  redesign 

Inspection  Access 

Restricted  space  changes 

Search 

Visual  search  training 

Task  lighting  design 

Decision 

Feedback  for  decision  training 

Individual  differences  in  NDI 

Inspection  Response 

Computer-based  workcards 

Initiate  Maintenance 

Maintenance  Site  Access 

Diagnosis 

Diagnostic  training 

ITS  computer-based  job  aid 

Maintenance  Part  Access 

Replace/Repair 

International  differences 

Reset  System 

Inspection  Buy-back 

International  differences 

Close  Access 

Maintenance  Response 

Here  we  will  explore  one  intervention  in  a  little  more  depth,  that  of  improved  communication  through  better 
document  design. 

The  work  documents  themselves  serve  a  number  of  different  purposes.  First,  they  are  part  of  a  work  control 
system  that  assures  that  all  tasks  are  completed  according  to  a  time  schedule.  Assigning  a  work  card  to  a 
mechanic,  and  receiving  it  back  with  the  stamps  and  data  completed,  allows  the  scheduling  system  to  function 
reliably.  Second,  the  workcard  is  part  of  a  quality  audit  trail  which  allows  management  to  analyze  tasks  at  a 
later  time  if  an  error  was  detected.  For  both  reasons,  the  interactions  of  mechanics  with  the  work  card  must 
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proceed  reliably  for  the  system  to  function  correctly.  Finally,  the  work  card  is  a  job  aid  in  the  Human  Factors 
sense  of  a  tool  used  to  help  reliable  performance  of  a  procedure.  Any  human/work  card  mismatches  in  this 
final  sense  will  compromise  the  overall  system  reliability.  Thus,  it  is  vitally  important  that  the  work  card  be 
designed  to  meet  user  needs,  i.e.  it  must  fit  the  mechanic  or  inspector. 

From  previous  research,  we  have  found  that  well-designed  documents  have  a  significant  impact  on 
performance  reliability.  Our  work  has  focused  on  layout  rather  than  content,  but  has  included  studies  of 
Simplified  English,  order  of  steps,  typography,  and  computer-presented  documents  (Patel  et  al  1994).  We 
have  also  shown  how  the  process  for  writing  and  changing  documents  using  user  teams  can  lead  to 
improvements.  Two  examples  are  worth  mentioning. 

First,  an  existing  airline  procedure  that  had  caused  operational  problems  was  analyzed  (Drury,  1998).  This 
document  required  9  inspector  responses,  and  had  yielded  an  error  rate  of  1.5%  of  responses,  meaning  that 
21%  of  all  documents  contained  at  least  one  error.  When  we  compared  the  errors  to  Human  Factors  guidelines 
for  good  document  design,  we  found  that  the  error  rate  was  2.5%  where  these  guidelines  were  violated,  and 
0.0%  where  they  were  met.  That  is,  ALL  of  the  errors  could  have  been  eliminated  by  following  good  Human 
Factors  practices. 

Second,  a  study  of  repair  station  errors  (Drury,  Kritkauski  and  Wenner,  1998)  compared  comprehension  of 
work  documents  used  by  two  different  airlines  with  those  designed  using  our  Documentation  Design  Aid 
(DDA).  Significant  differences  in  comprehension  errors  were  found  between  the  three  formats  on  two 
different  tasks: 


Cable  Workcard 

Wing  Workcard 

Errors 

Errors 

Airline  A  Format 

52% 

36% 

Airline  B  Format 

27% 

20% 

Documentation  Design  Aid 

4% 

17% 

Thus,  the  design  of  work  documents  DOES  impact  reliability.  It  is  not  just  a  matter  of  designing  to  please  operators,  or 
meeting  arbitrary  style  mles,  but  of  using  evaluated  data  to  improve  the  probability  that  a  document  will  be  used  correctly 
in  practice.  This  issue  of  improved  design  is  relatively  simple  to  incorporate  into  procedure  work  cards. 

These  documentation  design  rules  have  been  incorporated  into  a  Documentation  Design  Aid  (Drury,  2000) 
that  provides  both  rule-based  advice  and  knowledge-based  reasons  for  formatting  and  wording  improvements 
to  documents.  The  DDA  program  for  Windows  is  available  for  downloading  from  hfskywav.faa.gov. 

5.  Conclusions:  This  paper  provides  only  a  sampling  of  the  research  performed  and  products  made  available 
from  human  factors  in  aviation  maintenance  and  inspection  research  programs.  The  first  issue  in  developing  a 
human  factors  program  in  an  airline  or  other  maintenance  organization  is  to  recognize  that  human  error  will 
not  be  eliminated  by  blame,  motivation  or  even  most  training.  True  system  interventions  require  an  integrated 
approach  of  all  the  elements  in  the  SHELL  system:  software,  hardware,  environment,  liveware  and  liveware/ 
liveware  interaction.  Organizations  should  now  have  sufficient  data  and  incentive  to  undertake  human  factors 
programs.  This  paper  gives  a  logical  approach  to  error  reduction,  combining  error  investigation  and  task 
analysis-based  approaches. 

6.  Acknowledgement:  This  work  was  performed  under  contract  from  the  Office  of  Aviation  Medicine  (Ms. 
Jean  Watson),  Federal  Aviation  Administration. 
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Summary 

A  method  is  described  that  may  be  used  to  help  ensure  that  a  structural  material  or  process 
will  be  successful  when  transitioned  from  the  laboratory  for  replacement  of  existing 
materials  and  processes  in  an  aging  aircraft.  Experience  with  laboratory  and  aircraft 
development  programs  has  shown  that  five  factors  are  essential  for  success  in  the 
technology  transition  process.  An  example  is  shown  where  the  transition  using  this 
process  was  successful. 

Introduction 

Most  aircraft  operated  commercially  or  in  the  military  reach  a  state  referred  to  as  aging  at 
sometime  after  entering  operational  service.  Aging  of  an  aircraft  is  not  the  same  as  it 
becoming  obsolete.  An  aircraft  may  be  obsolete  before  it  reaches  the  aging  state  or,  more 
typically,  it  reaches  the  state  of  aging  before  it  is  obsolete.  A  commercial  aircraft  is 
obsolete  when  it  is  no  longer  economically  viable  to  keep  it  operational.  A  military 
aircraft  is  obsolete  when  its  capabilities  are  no  longer  competitive  with  potential 
adversaries.  The  time  when  an  aircraft  reaches  the  aging  state  is  usually  much  more 
difficult  to  determine.  It  is  important  to  distinguish  between  the  characteristics  of  the 
structure  of  a  young  aircraft  and  an  aging  aircraft.  A  young  aircraft  is  one  that  continues 
to  be  airworthy  with  the  maintenance  program  prescribed  at  the  time  of  manufacture.  The 
primary  concern  with  a  young  aircraft  is  the  potential  for  design  errors  that  introduce 
unintentional  high  stresses  in  the  structure  that  could  lead  to  premature  fatigue  cracking 
incidents.  When  these  are  discovered  the  structure  is  modified  to  eliminate  the  problem. 
An  aging  aircraft  may  be  characterized  as  one  where  the  effects  of  corrosion  and  cracking 
from  fatigue  require  modification  of  the  maintenance  program  to  retain  adequate  structural 
integrity.  The  word  adequate  here  means  that  the  expected  number  of  failures  would  be 
less  than  one  in  a  given  fleet  of  aircraft.  As  an  aircraft  accumulates  calendar  time  and 
flight  time  the  effects  of  corrosion  and  cracking  from  fatigue,  as  well  as  accidental 
damage,  leads  to  repairs  on  the  aircraft.  Cracking  from  fatigue  can  be  so  widespread  that 
it  degrades  the  integrity  of  the  structure.  When  this  occurs,  the  structure  is  said  to  be  in  a 
state  of  widespread  fatigue  damage  or  WFD  and  must  undergo  modifications  to  remove 
this  problem.  In  addition,  as  an  aircraft  accumulates  flight  time,  it  may  exceed  its  design 
life  goal.  Therefore,  the  maintenance  program  will  require  modification  to  include 
additional  structural  inspections.  If  the  initial  maintenance  program  requires  modification 
from  any  of  these  events,  then  the  aircraft  may  be  considered  to  be  in  a  state  of  aging. 

No  one  should  be  surprised  there  are  aircraft  all  over  the  world  today  in  a  state  of  aging. 
Economic  considerations  demand  that  aircraft  be  operated  long  beyond  originally 
identified  retirement  times.  One  reason  for  keeping  aircraft  in  the  inventory  is  that 
technological  advances  allow  currently  designed  aircraft  to  effectively  perform  their 
mission  for  much  longer  than  previously  possible.  An  aircraft,  even  when  sold  by  one 
airline,  sees  extended  life  in  another  airline’s  operations.  In  the  commercial  sector,  new 
aircraft  tend  to  be  evolutionary  in  their  designs.  Consequently,  they  are  maintained  in 
service  until  they  are  not  economically  viable  to  operate.  The  cost  of  new  aircraft, 
particularly  for  the  military,  is  enormous.  Each  new  military  aircraft  is  a  revolutionary 
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change  from  the  previous  model  since  the  services  must  maintain  combat  effectiveness  in 
an  environment  of  ever-changing  threats.  Therefore,  military  aircraft  stay  in  the 
inventory  until  they  are  operationally  obsolete  or  they  are  no  longer  economically  viable 
to  operate. 

Sustainment  of  an  aircraft  is  the  act  of  keeping  it  operational  (i.e.,  airworthy). 
Maintenance  of  an  aircraft  (that  is,  the  work  done  by  mechanics  in  keeping  it  airworthy)  is 
one  aspect  of  sustainment.  However,  sustainment  also  includes  the  engineering  analyses 
and  tests  needed  to  determine  an  adequate  maintenance  plan  for  the  aircraft.  Sustainment 
is  life  management.  One  task  of  sustainment  is  the  determination  of  structural  inspections 
based  on  damage  tolerance  principles.  These  inspections  protect  against  failure  from 
defects  that  could  be  in  the  structure  because  of  manufacturing  or  from  operational 
service.  The  approach  for  developing  a  damage  tolerance  derived  inspection  program  is 
well  documented.  Another  task  of  sustainment  is  the  determination  of  the  time  of  onset  of 
fatigue  cracking  in  the  structure  so  widespread  that  the  structural  integrity  of  the  aircraft 
could  be  compromised.  Experimental  evidence  shows  that  fatigue  cracks  smaller  than 
those  that  could  be  easily  detected  by  current  inspection  methods  could  constitute  WFD. 

Today,  the  primary  concern  with  aging  aircraft  is  the  cost  of  their  sustainment.  The 
commercial  operators  buy  new  aircraft  when  it  becomes  economically  viable  for  them  to 
do  so.  The  aging  aircraft  problem,  however,  has  often  made  itself  known  to  both  the 
commercial  and  military  operators  through  failures  of  in-service  aircraft.  Both  operators 
found  the  maintenance  programs  did  not  adequately  protect  aircraft  as  they  progressed 
through  their  service  lives.  The  failures  in  both  commercial  and  military  aircraft  have 
been  the  primary  factor  that  has  changed  rules  and  specifications  that  are  the  basis  of  their 
design.  In  many  cases,  the  failures  have  identified  threats  to  structural  integrity  that  were 
not  previously  identified  by  the  certification  authorities.  In  many  cases,  the  commercial 
failures  have  influenced  the  military  specifications  and  the  military  failures  have 
influenced  the  commercial  aircraft  rules.  The  new  rules  and  specifications  have  lead  to 
better  maintenance  programs  that  help  alleviate  many  of  the  threats  to  failure  that 
previously  existed.  However,  the  economic  demand  to  fly  these  aircraft  longer  and  longer 
has  emphasized  the  need  to  re-examine  these  aircraft  for  the  possibility  of  WFD,  corrosion 
damage,  and  loss  of  damage  tolerance  capability  through  repairs. 

It  is  difficult  to  determine  the  exact  moment  in  time  when  an  aircraft  has  reached  the  state 
of  aging.  However,  all  would  agree  that  the  costs  associated  with  repairs  or  modifications 
from  corrosion  or  cracking  from  fatigue  would  be  an  indicator  of  this  condition.  When 
these  costs  rise  significantly,  then  the  aircraft  are  certainly  in  that  state.  Chronological 
age  is  not  always  a  good  indicator  of  aging.  However,  since  corrosion  and  fatigue  are 
somewhat  related  to  time  in  service,  it  does  give  some  insight  for  the  potential  of  this 
problem. 

The  time  of  development  an  aircraft  is  an  important  factor.  Many  development  programs 
for  materials  in  the  fifties  and  sixties  responded  to  aircraft  performance  needs.  At  this 
time,  the  material  suppliers  introduced  high  strength  low  ductility  alloys  in  an  attempt  to 
satisfy  the  demand  for  less  structural  mass.  Integrity  programs  such  as  USAF  Aircraft 
Structural  Integrity  Program  (ASIP)  were  either  nonexistent  or  immature.  Consequently, 
there  was  a  lack  of  knowledge  of  threats  to  structural  integrity 

The  structural  engineer  is  fortunate  to  have  many  new  technologies  that  could  be  used  to 
help  in  meeting  the  challenges  of  aging  aircraft.  Some  of  these  new  technologies  have 
been  the  basis  for  the  sustainment  of  the  aging  fleets.  There  are  several  life  enhancement 
techniques.  An  example  of  this  is  the  cold  expansion  of  fastener  holes  to  improve  their 
fatigue  resistance.  An  outgrowth  of  this  technology  for  the  bushing  of  lugs  has  proved  to 
be  quite  useful.  The  use  of  shot  peening  and  laser  peening  have  been  shown  to  be  useful 
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for  both  crack  and  corrosion  resistance  improvement.  Another  technology  is  the  use  of 
boron  composite  repair  of  cracks  and  corrosion.  This  technology  is  in  use  extensively  in 
the  C-130  and  C-141  aircraft  to  extend  their  useful  lives.  Protection  approaches  such  as 
improved  coatings  and  corrosion  prevention  compounds  have  found  use  in  both  military 
and  commercial  aircraft.  Many  aircraft  have  used  replacement  of  existing  materials  to 
reduce  the  cost  burden  of  maintaining  structural  integrity.  One  example  of  this  is  the 
replacement  of  the  lower  wing  skins  on  the  KC-135  aircraft.  Other  successful  applications 
include: 

Replacement  of  the  F-16  479  bulkhead  with  2097  aluminum  lithium  to  replace  existing 
2024-T85 1 

Replacement  of  the  7178-T6  KC-135  wing  upper  surface  with  7075-T73 

Replacement  of  the  7079-T6  C-5A  fuselage  skins  with  7475-T761. 

There  are  many  other  examples  of  successful  transitions  of  technology  from  the  laboratory 
to  engineering  and  manufacturing  development.  Many  of  these  successes  were  derived 
from  a  well-conceived  plan  or  "road  map”  that  formed  the  basis  or  criteria  for  technology 
transition.  In  general,  these  road  maps  have  included  programs  directed  at  several  levels 
of  technology  maturity.  These  levels  are  referred  to  as  basic  research,  exploratory 
development,  advanced  development  and  manufacturing  technology  development.  Most  of 
the  advanced  development  and  manufacturing  technology  development  program  effort  is 
directed  towards  the  demonstration  of  the  technology  by  means  of  the  manufacture  and 
testing  of  a  specific  piece  of  hardware. 

A  study  of  those  successful  road  maps  for  transition  of  technology  to  engineering  and 
manufacturing  development  reveals  that  that  they  had  certain  factors  in  common.  These 
factors  may  be  combined  to  form  a  criterion  for  the  transition  process  to  be  successful. 
The  importance  of  such  a  criterion  for  incorporating  new  structural  technologies  into  an 
aircraft  can  be  judged  from  transition  experiences  that  were  not  successful.  There  are 
many  examples  that  could  be  used  to  illustrate  this.  One  example  that  has  resulted  in 
tremendous  cost  in  money  and  productivity  is  the  use  of  the  high  strength,  low  toughness 
7XXX-T6  aluminum  alloys  in  the  fifties  and  sixties.  The  attractiveness  of  the  weight 
reductions  realized  through  their  high  strength  caused  the  structural  design  engineers  to 
utilize  these  alloys  in  many  product  forms  and  locations  in  the  airframe.  Therefore,  in 
many  cases  they  were  improperly  incorporated  in  engineering  and  manufacturing 
development.  This  was  done  without  serious  consideration  of  their  susceptibility  to 
failure  from  corrosion,  stress  corrosion  cracking,  and  manufacturing  and  service  induced 
defects.  An  example  of  use  of  this  material  based  on  strength  considerations  only  is  the 
skin  of  the  lower  wing  of  the  KC-135,  which  was  originally  manufactured  from  7178-T6. 
The  inability  to  maintain  the  integrity  of  this  structure  in  operational  use  because  of 
fatigue  cracking  resulted  in  the  replacement  of  the  lower  wing  skin  on  more  than  700  of 
these  aircraft.  The  corrosion  problems  experienced  in  the  7075-T6  used  in  the  center 
section  of  the  C-141  wing  resulted  from  inadequate  sealing  of  the  structure  from  the 
environment.  This  has  caused  and  will  continue  to  cause  significant  cost  problems  with 
that  weapon  system.  The  KC-135  and  the  C-141  are  two  of  many  that  have  experienced 
dramatic  increases  in  their  maintenance  burden  because  these  alloys  were  used  in 
applications  that  were  not  compatible  with  their  characteristics.  The  material  problems 
are  not  restricted  to  aluminum.  Improper  use  of  magnesium,  titanium,  and  steel  has  also 
resulted  in  high  maintenance  costs.  In  addition,  to  materials,  processes  have  also 
experienced  deficiencies  in  the  transition  criteria  from  the  laboratory  environment  to 
engineering  and  manufacturing  development  as  evidenced  by  the  early  manufacturing 
problems  with  the  F-16  horizontal  tail  composite  parts. 
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There  are  also  many  examples  of  faulty  transition  criteria  led  to  serious  problems  in 
engines.  As  with  the  airframe,  there  are  numerous  examples  where  this  has  caused 
problems.  One  of  these  is  the  use  of  low  ductility  titanium  in  the  F100  fan  blades  and  fan 
disks.  This  usage  led  to  extremely  small  critical  flaw  sizes  and  consequently  a  costly 
maintenance  burden.  This  situation  was  corrected  by  a  redesign.  Another  example  was 
the  use  of  powdered  Rene  95  in  the  F-101  engine.  The  database  for  use  of  this  material 
was  generated  from  small  coupons.  However,  when  the  process  was  scaled  up  to  full  size 
parts,  the  associated  contamination  degraded  the  properties  to  the  point  that  a  substitute 
material  had  to  be  used. 

Another  reason  for  establishing  a  criterion  for  transition  is  that  there  is  a  need  for 
understanding  the  limitations  on  the  technology.  The  laboratory  demonstration  program  is 
seldom  of  sufficient  scope  such  that  provide  confidence  that  all  aspects  of  a  given 
technology  are  suitable  for  operational  use.  Therefore,  there  is  a  danger  that  the  engineer 
responsible  for  technology  development  may  use  it  improperly.  There  is  also  the  danger 
of  an  acceptable  application. 

It  is  the  intent  of  this  paper  to  describe  the  essential  features  of  a  criterion  for  successful 
transition  of  a  structural  technology  from  the  laboratory  to  engineering  and  manufacturing 
development  of  a  production  aircraft.  It  has  been  demonstrated  by  service  experience  that 
the  USAF  Aircraft  Structural  Integrity  Program  (ASIP)  [1]  has  the  elements  necessary  to 
ensure  that  production  aircraft  developed  from  these  requirements  will  be  safe  and 
economical  to  operate.  The  ASIP  was  initially  developed  in  1958  [2]  to  preclude  the 
reoccurrence  of  some  catastrophic  failures  that  took  place  at  that  time.  It  was  updated  in 
the  early  seventies  to  include  the  currently  used  damage  tolerance  philosophy  for 
structural  design.  All  aircraft  used  or  developed  by  the  Air  Force  are  subject  to  the 
requirements  of  the  ASIP. 

The  ASIP  provides  the  guidance  for  the  engineering  and  manufacturing  development  phase 
of  an  aircraft.  Consequently,  its  importance  for  this  paper  is  that  a  structural  technology 
may  be  judged  against  the  elements  of  the  ASIP  to  help  determine  if  it  is  suitable  for 
transition  to  this  phase.  Although  the  ASIP  was  conceived  before  the  development  of 
composites,  the  process  may  be  easily  tailored  to  these  structures  [3]. 

Technology  Transition  Criteria 

From  a  study  of  the  successful  transitions  of  structural  technologies  from  the  laboratory  to 
an  operational  aircraft,  it  was  found  that  five  factors  constituted  a  common  thread  among 
these  successes.  In  addition,  it  was  found  that  these  five  factors  were  essential  to  the 
successful  completion  of  the  tasks  of  the  ASIP.  These  five  factors  are: 

1.  Stabilized  material  and/or  material  processes 

2.  Producibility 

3.  Characterized  mechanical  properties 

4.  Predictability  of  structural  performance 

5.  Supportability 

In  the  listing,  there  was  no  attempt  to  establish  a  ranking  of  importance  of  these  factors. 
A  deficiency  in  any  one  of  the  factors  could  constitute  a  fatal  defect. 
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It  is  readily  seen  that  stabilized  material  and/or  material  processes  are  essential.  With  the 
time  constraint  on  establishing  the  final  allowables,  any  significant  change  in  the  material 
or  processing  could  be  disastrous.  However,  it  is  not  expected  that  all  of  material  and 
processing  specifications  be  completed  at  the  start  of  material  or  process  substitution 
process.  It  is  adequate  to  have  preliminary  documentation  of  the  following: 

Material  qualification  and  acceptance  specifications 

Processing  specification  and  acceptance  standards 

Manufacturing  instructions 

This  factor  must  address  the  issue  of  corrosion.  It  is  expected  at  the  start  of  the  material 
and  substitution  process  that  the  corrosion  resistance  of  the  material  be  characterized.  In 
addition,  the  analyst  should  establish  the  requirements  for  cladding,  anodizing,  priming 
and  top  coating. 

Several  producibility  considerations  must  be  addressed.  First,  the  material  supplier  must 
be  capable  of  supplying  the  material  in  appropriate  quantity  and  forms.  Experience  has 
shown  that  the  time  required  for  scaling  up  material  sizes  or  changing  product  forms  is 
generally  not  compatible  with  time  available  to  implement  the  desired  change.  Even  in 
the  case  of  large,  but  state  of  the  art,  forgings  care  must  be  exercised  because  the 
properties  are  extremely  configuration  dependent. 

Another  producibility  requirement  is  to  use  the  technology  to  fabricate  detail  parts  and 
assemblies.  For  this  purpose,  generally  full-scale  parts  are  required.  This  fabrication 
must  cover  the  range  of  forming  parameters  and  material  heat  treat  conditions  that  are 
appropriate.  In  rare  cases,  fabrication  of  subscale  parts  could  be  acceptable  if  the 
behavior  of  the  full-scale  parts  can  be  confidently  predicted. 

Inspectability  through  the  manufacturing  process  is  another  essential  issue  in  the 
producibility  factor.  If  conventional  methods  are  appropriate  then  they  must  be  identified 
and  approximate  capability  established  for  the  critical  locations.  If  new  methods  are 
required  then  they  must  have  progressed  beyond  the  laboratory  stage  and  have  a 
demonstrated  capability  to  perform  the  intended  inspections. 

It  must  be  demonstrated  that  the  manufacturing  process  is  compatible  with  the  shop 
environment.  The  government  environmental  standards  that  are  imposed  on  the 
manufacturing  facility  may  have  a  severe  impact  on  the  allowed  processes.  This  problem 
is  aggravated  by  the  fact  that  these  standards  are  rapidly  changing  and  becoming  more 
severe. 

Of  all  the  factors  in  the  transition  criteria,  characterized  mechanical  properties  is  the  most 
difficult  to  identify  the  specific  requirements.  There  are  three  guiding  principles  that 
should  be  used  to  establish  these  requirements.  One  of  these  is  that  the  final 
characterization  should  be  complete  before  the  design  process  is  complete.  Another  is 
that  at  the  start  of  the  design  process  the  properties  should  be  established  with  sufficient 
accuracy  to  determine  the  weight  of  the  structure.  The  final  guideline  is  that  property 
investigation  should  be  extensive  enough  in  scope  to  preclude  the  possibility  that  the 
technology  will  fail  to  reach  its  intended  purpose.  In  some  cases  this  may  require  an 
evaluation  of  the  material  or  process  characteristics  when  exposed  to  nuclear  and/or  non¬ 
nuclear  threats.  The  initial  emphasis  should  be  on  the  assessment  of  many  characteristics 
of  the  technology  rather  than  an  in-depth  assessment  of  any  single  one  of  them. 
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As  a  minimum,  the  following  mechanical  properties  must  be  evaluated  in  the  presence  of 
environmental  effects: 

Strength  -  Coupon  tests  are  required  for  tension,  compression,  shear,  and  bearing  for 
yield  and  ultimate  as  appropriate 

Modulus  -  Coupon  tests  as  appropriate  are  required  to  derive  the  stress  strain 
relationship 

Elongation  -  Coupon  tests  as  appropriate  are  required 

Fracture  Toughness  -  For  metals,  Kjc,  Kc  data  and  R  curve  data  are  required  as  needed 
for  establishing  design  stresses 

Crack  Growth  Rate  -  For  metals,  data  required  for  range  of  values  of  R  expected  in 
operational  aircraft 

Dimensional  stability  -  includes  data  for  potential  creep  effects  to  be  expected  in 
operational  aircraft  and  thermal  coefficient  of  expansion  data 

Stress  Corrosion  Cracking  -  Either  Kjscc  data  or  stress 

Threshold  data  required  for  thickness  and  product  form  combinations  expected  to  be 
found  in  the  operational  aircraft 

For  many  technologies,  it  is  not  adequate  to  base  the  success  of  a  technology  on  coupon 
data.  For  example,  in  many  composite  structures  the  interlaminar  stresses  produce  critical 
failure  modes  that  can  not  be  confidently  interrogated  in  the  coupon  level  tests.  It  is 
expected  that  appropriate  element  and  subcomponent  tests  (i.e.,  building  block  tests)  be 
performed.  Generally,  strength,  durability,  and  damage  tolerance  testing  will  be 
performed  in  these  building  block  tests. 

The  three  guidelines  stated  above  are  believed  to  be  adequate  to  determine  the  quantity  of 
data  needed.  However,  some  additional  guidance  may  be  useful.  For  the  coupon  strength 
tests,  a  minimum  of  four  tests  from  each  of  four  material  lots  would  satisfy  the 
requirement  for  transition.  This  database  would  not  be  adequate  for  the  generation  of 
allowables  as  recommended  in  MIF-HDBK-5.  However,  the  database  should  be  adequate 
for  establishing  the  Weibull  parameters  and  making  usable  preliminary  estimates  of  the 
allowables.  For  fracture  toughness,  the  contractor  should  supply  metal  materials  with 
fracture  toughness  with  a  minimum  guaranteed.  Therefore,  the  tests  should  demonstrate 
that  there  is  a  balance  between  structural  performance  and  economics  of  procurement.  For 
rates  of  crack  growth  in  metal  structures  (i.e.,  da/dn  data)  average  properties  are 
acceptable.  However,  multiple  tests  are  needed  to  estimate  the  variance  in  this  data.  If 
the  analyst  judges  these  variances  as  excessive,  then  there  should  be  a  reassessment  of  the 
material  and  process  specifications  to  try  to  reduce  the  scatter  in  this  property. 

Prediction  of  structural  performance  is  an  important  factor  because  the  full-scale  static, 
durability,  and  damage  tolerance  tests  are  very  expensive.  Therefore,  there  should  be 
reasonable  expectation  that  the  analyses  and  design  development  tests  preceding  these 
tests  would  lead  to  success.  Further,  and  even  more  important,  is  that  a  structure 
developed  under  the  ASIP  will  provide  safe  and  economic  operation  of  production  aircraft. 
Generally,  the  predictability  of  structural  performance  can  be  validated  with  a 
subcomponent  test.  That  is,  a  section  of  a  wing  or  fuselage  etc.  would  be  adequate. 
These  tests  must  be  carefully  designed  to  ensure  that  all  potential  critical  load  paths  are 
assessed. 


16-7 


Usually  the  key  to  satisfying  the  predictability  factor  for  structural  performance  is  sound 
analytical  procedures.  This  is  the  hallmark  of  currently  used  metallic  materials.  For 
these  materials,  critical  strength  failure  modes  in  tension,  compression,  shear,  and  bearing 
are  predictable.  Further,  the  availability  of  crack  growth  laws  for  metals  permits  the 
damage  tolerance  capability  to  be  established.  For  composite  structures,  the  analytical 
procedures  are  still  emerging.  Difficulties  persist  in  the  prediction  of  interlaminar 
stresses  and  the  growth  of  delaminations  derived  from  impact  damage.  However,  these 
problems  can  be  handled  with  empirical  methods.  When  empirical  processes  can  be  used 
confidently  then  this  factor  can  be  satisfied. 

The  damage  tolerance  era,  which  started  in  the  early  seventies,  has  helped  to  reduce  some 
of  the  supportability  requirements  for  currently  designed  aircraft.  However,  the 
supportability  factor  is  still  a  major  consideration  because  of  accidental  and  battle 
damage.  Any  new  structural  concept  forces  the  maintainers  and  the  operators  to  prepare 
to  make  repairs.  This  places  demands  on  supply  lines  and  training  of  personnel.  The 
establishment  of  facilities  with  trained  personnel  normally  lags  the  development  of  the 
technology  significantly.  For  example,  the  composite  repair  capability  for  in-service 
aircraft  is  only  now  maturing  but  the  composite  technology  has  been  transitioned  to 
operational  aircraft  for  approximately  two  decades.  Further,  the  acceptance  of  a  new 
technology  by  the  maintainers  and  operators  may  place  a  large  economic  burden  on  them. 
This  could  be  difficult  to  justify.  Consequently  as  a  prerequisite  for  transition,  the 
repairs  associated  with  the  technology  must  be  at  least  conceptually  developed.  That  is, 
the  repair  must  be  viable  in  the  using  command  environment  and  must  be  manageable  from 
economic  considerations. 

In  addition  to  the  repair  aspect  of  supportability,  inspectability  must  be  addressed.  This 
includes  both  manufacturing  and  in-service  inspections.  If  the  inspections  required  are 
not  viable  with  existing  equipment  then  there  must  be  reasonable  assurance  that  these 
inspections  can  be  made  when  they  are  needed. 

Example  of  Successful  Transition  of  Technology 

Previous  and  current  inspection  programs  have  revealed  that  the  vertical  tail  attachment 
pads  in  the  F-16  Fuselage  Station  479  bulkhead  are  significantly  cracked  in  the  majority 
of  early  aircraft.  Figure  1  shows  the  configuration  of  the  bulkhead  and  Figure  2  shows  the 
area  where  cracking  has  been  experienced.  The  depot  responsible  for  F-16  maintenance 
has  considerable  experience  in  the  eddy  current  inspection  for  these  cracks  and  have 
established  appropriate  guidelines  for  the  disposition  of  cracks  found  in  operational 
aircraft.  The  root  cause  of  this  cracking  is  high  stress  concentration  inherent  in  the  detail 
design  compounded  by  increased  usage  severity  precipitated  by  weight  increases  in  the 
aircraft  without  compensating  structural  modifications.  The  stresses  at  the  point  of  crack 
initiation  are  extremely  high  although  they  do  decrease  with  increasing  crack  depth. 
These  high  stresses  cause  early  cracking  in  the  structure. 
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Figure  1  The  Fuselage  Station  479  Vertical  Tail  Attachment  Bulkhead 


Figure  2  The  Fuselage  Station  479  Bulkhead  Area  of  Cracking 

Normally,  the  USAF  would  not  fly  these  aircraft  with  known  cracking.  In  this  situation 
the  situation  is  relieved  because  the  vertical  tail  structure  has  been  analytically  shown  to 
have  adequate  fail-safety  in  the  event  of  a  failure  of  the  F.S.  479  bulkhead. 

Preliminary  studies  showed  that  the  fracture  toughness  of  aluminum  lithium  was  high 
enough  such  that  a  crack  would  grow  through  stable  propagation  through  the  high  stress 
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concentration  region.  This  feature  enabled  the  bulkhead  to  remain  in  service  considerably 
longer  than  the  baseline  bulkhead.  However,  it  would  be  expected  to  have  crack 
indications  early  in  its  life  because  of  the  inherent  high  stress  at  the  radius.  Its  structural 
integrity  would  be  ensured  through  fail-safety. 

Consequently,  these  studies  indicated  that  the  use  of  a  new  bulkhead  material  identified  as 
2097  aluminum  lithium  would  provide  considerable  improvement  in  the  structural 
integrity  in  this  location.  The  original  material  was  2024-T851  aluminum.  The  USAF 
requested  the  contractor  to  develop  a  program  around  the  five  elements  of  technology 
transition  for  a  new  material  or  process.  These  five  elements  are;  (1)  stabilized  material 
and  processes,  (2)  producibility,  (3)  characterized  mechanical  properties,  (4),  prediction 
of  structural  performance,  and  (5)  supportability. 

The  2097  material  satisfies  the  first  element  -  stabilized  material  and  material  processes. 
The  material  specification  has  been  finalized  and  significant  amounts  of  the  material  have 
been  produced  to  this  specification.  All  of  the  replacement  components  will  be  procured 
to  this  specification.  The  boundaries  of  the  processing  parameters  have  been  examined 
and  no  significant  degradation  of  properties  has  been  observed. 

The  second  element  -  producibility  has  been  satisfied  in  that  full-scale  parts  have  been 
fabricated  with  the  same  tools  that  were  used  to  fabricate  the  conventional  aluminum 
parts.  There  have  been  no  toxicity  issues  found  for  the  handling  and  machining  of  the 
forged  part.  Also,  the  scrap  disposal  is  feasible  without  contamination  of  the 
conventional  alloys. 

The  third  element  -  characterized  mechanical  properties  was  completed.  Since  the  final 
strength  properties  had  not  been  characterized  to  the  MIL-HDBK-5  standards,  the  design 
team  used  S-values  for  strength  characterization.  The  strength  properties  that  are 
significant  to  this  application  for  the  2097  material  exceed  the  strength  of  the  baseline 
conventional  aluminum.  The  fracture  properties  are  well  characterized  for  the  “long 
crack”  analyses  that  would  be  used  for  this  bulkhead.  The  corrosion  resistance  has  been 
successfully  demonstrated  through  the  EXCO  test  procedure.  Also,  the  stress  corrosion 
cracking  thresholds  are  in  excess  of  the  baseline  material,  which  has  performed  well  with 
respect  to  this  issue. 

The  fourth  element  -  predictability  of  structural  performance  had  to  be  satisfied  by  a 
combined  analysis  and  test  program.  Conventional  linear  fracture  mechanics  approaches 
were  not  able  to  completely  characterize  the  growth  of  small  cracks.  The  problem  was 
that  the  very  high  stress  concentration  in  the  area  of  cracking  increased  the  strains  beyond 
the  yield  point.  Therefore,  the  contractor  used  component  testing  to  augment  the 
analytical  results  to  ensure  that  the  new  material  was  significantly  better  than  the  baseline 
material. 

The  fifth  element  -  supportability  was  found  to  be  adequate.  Aluminum  lithium  has  the 
characteristic  that  the  fracture  face  is  quite  rough  compared  with  the  baseline  material. 
However,  this  should  not  be  an  inhibitor  to  making  an  inspection  for  cracks  in  operational 
aircraft.  This  was  demonstrated  through  component  testing. 

Therefore,  the  team  recommends  that  the  aluminum  lithium  material  be  used  for  the  F.S. 
479  bulkhead  replacement. 

Conclusions 

This  paper  has  discussed  the  five  factors  believed  to  be  essential  for  successful  transition 
of  a  technology  from  the  laboratory  to  successful  application  on  operational  aircraft. 
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Experience  has  shown  that  deficiencies  in  these  factors  will  result  in  a  less  than 
satisfactory  operational  performance.  It  is  evident  that  there  is  considerable  judgment 
involved  in  addressing  each  of  these  factors.  However,  it  is  believed  that  the  effort 
required  in  making  this  judgment  is  justified  when  the  consequences  of  using  a  deficient 
technology  are  considered. 
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